Django 5.2

Apply the Python 3 baseline first, then these rules for Django 5.2. Use the latest supported 5.2.x patch on a maintained, compatible Python release. Preserve Django's protections; document and test any necessary exception.

Security baseline

• Prefer Django's forms, ORM, templates, authentication, session, CSRF, signing, and security middleware over custom security code.
• Set security controls in production settings without permissive fallbacks; run manage.py check --deploy against those settings and resolve its security warnings.
• Keep DEBUG = False and use a production WSGI or ASGI server, never manage.py runserver.

Authentication

• Verify credentials with django.contrib.auth.authenticate(); reject None and pass only an authenticated user to login().
• Establish and end sessions with Django's login() and logout(), not manual session-key edits.
• After saving a custom password change, call update_session_auth_hash() to retain the current login and rotate its key.
• Protect function views with @login_required, class views with leftmost LoginRequiredMixin.
• For deny-by-default sites, place LoginRequiredMiddleware after AuthenticationMiddleware; use @login_not_required for intended public views, including login and recovery, to avoid redirect loops.
• Retain ModelBackend inactive-user rejection; enforce is_active in every custom backend.
• Return None for invalid credentials; raise PermissionDenied only to stop later backends.
• Add application/proxy/server rate limiting for login, password-reset, and other credential