The Django Patterns We See Most

The five most common

1. Query multiplication — lazy loading in loops
2. Record-level permissions missing — action checked, ownership not
3. Debug left on in production
4. Email through the default backend, silently not arriving
5. No tests around the business rules and permissions

The second is the most serious. A user permitted to view orders viewing someone else's order is a data breach, and it is depressingly common.

Five more

• Business logic in views, so it cannot be reused or tested
• Fat models with everything in save methods, so ordering matters and nothing is clear
• Secrets in settings committed to the repository
• Media served from the code directory
• Migrations edited after being applied somewhere

Costs

All fixable without a rewrite

Every one of these is addressable incrementally in an existing application. None requires replacement, which is worth knowing before anyone proposes one.

Fix the permissions and the production settings first — those are the ones with the most serious consequences.

How to find them

1. Run Django's deployment check — seconds, catches configuration
2. Log query counts per page — finds multiplication immediately
3. Try to access another user's record — finds permission gaps
4. Send yourself an email from production — checks delivery
5. Look for tests around the calculations — usually absent

Frequently asked questions