One forgotten line in settings.py can show your whole configuration to visitors (DEBUG = True) or let anyone forge sessions (a SECRET_KEY in the repository). This skill finds those and nine other Django settings mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your settings files: settings.py, a settings/ folder (base.py, production.py) and local_settings.py. It reads them with Python's own parser, so it understands real code, including settings inside if and try blocks and fallback defaults in environment lookups. It never imports or runs your settings. Development and test settings files are read but not reported. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Keys and passwords are never printed.

What it checks

BLOCK (fix before shipping)

• D01: DEBUG = True, also when an environment lookup defaults to true

• D02: a SECRET_KEY written in the file, or used as a hardcoded fallback default

• D03: '*' in ALLOWED_HOSTS

• D04: a database password or a database URL with a password in DATABASES

• D05: another secret setting in the file, such as EMAIL_HOST_PASSWORD or AWS_SECRET_ACCESS_KEY

REVIEW (check before release)

• D11: MIDDLEWARE without CsrfViewMiddleware

• D12: session or CSRF cookies set to insecure, or the session cookie readable by JavaScript

• D13: SECURE_SSL_REDIRECT off or SECURE_HSTS_SECONDS = 0

• D14: django-cors-headers allowing every origin

• D15: an MD5, SHA1, unsalted or crypt hasher first in PASSWORD_HASHERS

• D16: an empty AUTH_PASSWORD_VALIDATORS list

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example settings, and the real report the scanner produces on the risky one

Limits

Each settings file is checked on its own, so values imported with from .base import * or set by environment variables are not seen. Run python manage.py check --deploy too. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 7 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (2 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.