django

A set of coding rules for Django, a Python web framework, covering project structure, web requests, database models, settings, and URLs.

In plain words
What is it for?
Use it when building or reviewing Django applications, especially when setting up apps, views, models, settings, URL patterns, and database indexes.
Why use it?
It helps keep Django code organized and reduces common problems such as business logic in request handlers, hardcoded links, exposed secrets, and slow database queries.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/nedcodes-ok/cursor-doctor/django
Clone the repo
git clone --depth 1 https://github.com/nedcodes-ok/cursor-doctor
Per session 1,072 This file is loaded in full into every session.
When invoked 1,072 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01072 $0.01072
Opus 5 $0.00536 $0.00536
Sonnet 5 $0.00214 $0.00214
Haiku 4.5 $0.00107 $0.00107

Measured 2d ago against content hash aa501b6f1a3e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

django scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to django — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

pro-kit/templates/frameworks/django.mdc · 52 lines

How it starts

The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Django Cursor Rules

You are an expert Django developer (v4.2+/v5+). Follow these rules:

Structure

  • App-based architecture — each app is independently testable and has a clear domain boundary
  • Thin views — business logic belongs in service functions or model methods, not in view code. Views handle HTTP concerns only: parse request, call service, return response
  • CBVs (Class-Based Views) for standard CRUD patterns, FBVs (Function-Based Views) for custom logic that doesn't fit CRUD
  • Separate settings: base.pydevelopment.py / production.py that import from base. Never put secrets in settings files — use environ or django-environ
  • URL patterns: use path() with named URLs everywhere. reverse('app:name') in code, {% url 'app:name' %} in templates — never hardcode URLs

Models

  • db_index=True on fields you filter, order, or join on frequently. Missing indexes are the #1 performance issue in Django apps
  • CharField with TextChoices enum, not raw strings — catches typos at the Python level and gives you .label for display
  • Override __str__ on every model — admin, shell, and logging become usable. UUIDField for public-facing IDs, auto-increment pk stays internal
  • Always create data migrations when schema changes need data transformations — RunPython in migrations, not management commands that may not run
  • constraints in Meta for database-level validation: UniqueConstraint, CheckConstraint — model-level unique_together is legacy, use Meta.constraints
  • Set default_auto_field = 'django.db.models.BigAutoField' in settings — the default AutoField maxes out at ~2.1B rows

QuerySets

  • select_related() for ForeignKey/OneToOne (SQL JOIN). prefetch_related() for ManyToMany and reverse FKs (separate query). Forgetting these is the N+1 problem
  • F() for database-level field references (avoids race conditions in updates). Q() for complex OR/NOT filters
  • .exists() not len(qs) > 0 (stops at first row). .count() not len(qs) (SQL COUNT vs loading all objects into memory)
  • .only() / .defer() for models with large text/JSON fields you don't need — but accessing a deferred field triggers another query, so be deliberate
  • .iterator() for processing large querysets — without it, Django caches the entire result set in memory
  • Never evaluate querysets in loops that trigger more queries: for obj in queryset: obj.related.name is N+1. Profile with django-debug-toolbar or nplusone

Read the full file on GitHub · 52 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 52 lines · 1,072 tokens per session scan A aa501b6f1a3e

Subscribe to this mod's changes

django is a cursor rule published in the GitHub repository nedcodes-ok/cursor-doctor (9 stars, last pushed 5mo ago), licensed MIT. It adds 1,072 tokens to every session, about $0.0054 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to django, differing in 0 lines, and is treated as a copy.