An exposed .env, an unguarded admin URL, rate limiting that broke per-worker, missing security headers — the holes that show up on every real Django deployment, and the exact Django + Nginx fixes that closed …
This site hides a post unless is_published is True AND published_at is set and in the past. Why? Because a NULL published_at means "never scheduled" — and treating it as "publish now" would surprise you …
How to build live notifications, real-time feeds, and instant updates using Django + HTMX + WebSockets — without a single line of JavaScript framework code.