django-python

django-python is a cursor rule for Cursor from PostHog/posthog-foss. It costs 1,586 tokens per session, scanned A, original, MIT.

Coding rules for Python services built with Django, a framework for creating web applications and APIs. They cover naming, project structure, database access, and API endpoints.

In plain words
What is it for?
Use them when adding or reviewing Python files, Django models, views, middleware, database queries, or API endpoints.
Why use it?
They reduce inconsistent implementations and guide agents toward the repository's preferred Django patterns.

Cursor rule for Cursor

Written for Cursor: installed under .cursor/.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/posthog/posthog-foss/django-python
Clone the repo
git clone --depth 1 https://github.com/PostHog/posthog-foss

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for django-python

README.md
[![agentmods](https://agentmods.dev/badge/rules/posthog/posthog-foss/django-python.svg)](https://agentmods.dev/rules/posthog/posthog-foss/django-python)
Your own site
<a href="https://agentmods.dev/rules/posthog/posthog-foss/django-python"><img src="https://agentmods.dev/badge/rules/posthog/posthog-foss/django-python.svg" alt="Measured on agentmods" height="20"></a>
Per session 1,586 This file is loaded in full into every session.
When invoked 1,586 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01586 $0.01586
Opus 5 $0.00793 $0.00793
Sonnet 5 $0.00317 $0.00317
Haiku 4.5 $0.00159 $0.00159

Measured 2d ago against content hash 21aaf2617a77, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

django-python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/django-python.mdc · 115 lines

How it starts

The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.


description: Rules for writing Python services at PostHog (Python servers powered by the Django framework) globs: *.py alwaysApply: false

You are an expert in Python, Django, and scalable web application development.

Key Principles

  • Write clear, technical responses with precise Django examples.
  • Use Django's built-in features and tools wherever possible to leverage its full capabilities.
  • Prioritize readability and maintainability; follow Django's coding style guide (PEP 8 compliance for the most part, with the one exception being 120 characters per line instead of 79).
  • Use descriptive variable and function names; adhere to naming conventions (e.g., lowercase with underscores for functions and variables).

Django/Python

  • Use Django REST Framework viewsets for API endpoints.
  • Leverage Django’s ORM for database interactions; avoid raw SQL queries unless necessary for performance.
  • Use Django’s built-in user model and authentication framework for user management.
  • Follow the MVT (Model-View-Template) pattern strictly for clear separation of concerns.
  • Use middleware judiciously to handle cross-cutting concerns like authentication, logging, and caching.

Error Handling and Validation

  • Implement error handling at the view level and use Django's built-in error handling mechanisms.
  • Prefer try-except blocks for handling exceptions in business logic and views.
  • Customize error pages (e.g., 404, 500) to improve user experience and provide helpful information.
  • Use Django signals to decouple error handling and logging from core business logic.

Dependencies

  • Django
  • Django REST Framework (for API development)
  • Celery (for background tasks)
  • Redis (for caching and task queues)
  • PostgreSQL (preferred databases for production)

Django-Specific Guidelines

  • Use Django templates for rendering HTML and DRF serializers for JSON responses.
  • Keep business logic in models and forms; keep views light and focused on request handling.
  • Use Django's URL dispatcher (urls.py) to define clear and RESTful URL patterns.
  • Apply Django's security best practices (e.g., CSRF protection, SQL injection protection, XSS prevention).
  • Leverage Django’s caching framework to optimize performance for frequently accessed data.
  • Use Django’s middleware for common tasks such as authentication, logging, and security.

Performance Optimization

  • Optimize query performance using Django ORM's select_related and prefetch_related for related object fetching.
  • Use Django’s cache framework with backend support (e.g., Redis or Memcached) to reduce database load.
  • Implement database indexing and query optimization techniques for better performance.
  • Use asynchronous views and background tasks (via Celery) for I/O-bound or long-running operations.
  • Optimize static file handling with Django’s static file management system (e.g., WhiteNoise or CDN integration).

Logging

  • As a general rule, we should have logs for every expected and unexpected actions of the application, using the appropriate log level.
  • We should also be logging these exceptions to error tracking with the PostHog Python SDK. Python exceptions should almost always be captured automatically without extra instrumentation, but custom ones (such as failed requests to external services, query errors, or Celery task failures) can be tracked using capture_exception().

Log Levels

  • A log level or log severity is a piece of information telling how important a given log message is:
    • DEBUG: should be used for information that may be needed for diagnosing issues and troubleshooting or when running application in the test environment for the purpose of making sure everything is running correctly
    • INFO: should be used as standard log level, indicating that something happened
    • WARN: should be used when something unexpected happened but the code can continue the work
    • ERROR: should be used when the application hits an issue preventing one or more functionalities from properly functioning

Read the full file on GitHub · 115 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 115 lines · 1,586 tokens per session scan A 21aaf2617a77

Subscribe to this mod's changes

django-python is a cursor rule published in the GitHub repository PostHog/posthog-foss (712 stars, last pushed today), licensed MIT. It adds 1,586 tokens to every session, about $0.0079 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.