Your Django project, audited against the settings you actually shipped

Paste settings.py — or the production module of a settings package — plus whichever of urls.py, your views, models, serializers, forms, templates and requirements.txt you have. You get a posture verdict, a control-by-control table, the findings that matter with a corrected fragment each, a hardened settings block, and the commands to prove it worked.

Both examples ship with a saved model run, so you can see the whole audit — including the hardened settings block — without signing in and without spending a credit.

Your Django project nothing pasted yet

Drag files in, or Everything is read in your browser. Nothing uploads until you run.

Audit against

Emphasis

Context — optional, but it changes the ordering

Paste a project to price the run.

posture

Django

audited against

findings

critical + high

Controls

Control	Status	Evidence	Requirement

Findings

Hardened settings

Verify

Read every line before running it. Nothing here is executed by this page.

Prescan reconciliation

Inventory

Kind	Name	Value	Role

Quick wins

Focus areas

Summary

Raw model reply

The reply did not parse as the structured audit, so it is shown as it arrived.

What this does, and what it does not

The prescan is real parsing, not a keyword search. Top-level assignments in every settings module are read into values, so DEBUG being computed is reported differently from DEBUG = True; MIDDLEWARE is walked as an ordered list, so SecurityMiddleware sitting third is a different flag from it being absent; and raw SQL call sites are read argument by argument, so a query that passes its values through the params argument is recognised as correct and left alone while an f-string in the same file is flagged. Everything it finds is handed to the model as facts it must reconcile, and the audit is checked against them afterwards — if the model skips a flag, this page says so.

It reads; it does not run anything, and it never reaches your servers. This is a review of the text you pasted, not a penetration test, a dependency CVE scan or a substitute for python manage.py check --deploy — which is the last command every audit here ends with. A secret you paste is a secret you should rotate: the audit is told to name it rather than repeat it, and this page checks the returned settings block for any value it echoed back anyway.

Nothing to hand? Load the , a Django 3.2 app with DEBUG on and a committed key, or the , which is mostly right and wants confirmation plus an HSTS ramp. Both replay a saved run for free.