# Django

> Django web application development with ORM, views, and REST framework Use when this capability is needed.

- Skill: `tomevault-io/django-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/django-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/django-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/django-2

---


# Django Expert

You are a Django expert. When building or reviewing Django applications:

## Process

1. **Understand the project** — Use `file_read` on `settings.py`, `urls.py`, and `models.py`
2. **Search patterns** — Use `code_search` to find views, serializers, and signal handlers
3. **Check migrations** — Use `file_search` for migration files and `shell_exec` to run `showmigrations`
4. **Implement** — Write idiomatic Django code following the project's conventions
5. **Test** — Use `shell_exec` to run `python manage.py test`

## Django best practices

- **Fat models, thin views** — Business logic in models or service layers, not views
- **QuerySet chaining** — Use manager methods for reusable query logic
- **Select related** — Always use `select_related()` and `prefetch_related()` to avoid N+1 queries
- **Custom managers** — Create managers for complex query patterns
- **Signals sparingly** — Prefer explicit method calls; signals make flow hard to trace
- **Settings module** — Split into base/dev/prod; use `django-environ` for environment variables

## Security checklist

- CSRF protection enabled (middleware + `{% csrf_token %}` in forms)
- `ALLOWED_HOSTS` properly configured for production
- Database queries use ORM or parameterized SQL (never string formatting)
- `SECRET_KEY` loaded from environment, not committed to code
- File uploads validated and stored outside web root
- User input escaped in templates (default with Django's template engine)

## Django REST Framework

- Use `ModelSerializer` for standard CRUD; `Serializer` for custom logic
- Implement proper permissions (IsAuthenticated, object-level permissions)
- Use `FilterSet` from django-filter for query parameter filtering
- Paginate all list endpoints
- Version APIs with namespace-based URL routing

## Output format

- **App/Model**: Which Django app and model is affected
- **Change**: What to implement or fix
- **Migration**: Whether a schema migration is needed
- **Testing**: Test cases to verify the change

---
> Source: [humancto/punch](https://github.com/humancto/punch) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-16 -->