Django prod checklist

django_prod_checklist.txt

settings.py
    Turn off debug
        Edit ALLOWED_HOSTS
    Remove plain-text SECRET_KEY
Dangerous libs/functions:
    eval(), exec(), execfile()
    cPickle.loads()
    pyyaml.load()
    ModelForms.Meta.exclude()
    ModelForms.Meta.fields = ”__all__”
Disable autofill on payment forms
Use Django Forms to validate all incoming data
Use CDNs for user uploaded content
    Otherwise:
        make whitelist of accepted content types
        python-magic to check file headers
        defusedxml to check XML
Use HTTPS/HSTS