Why Most Django Boilerplates Are Insecure by Default

You found a Django boilerplate on GitHub. It has 2k stars, a clean README, Docker support, and a Makefile. You clone it, rename a few things, push to production. Congratulations. You just shipped someone else's security assumptions. Every boilerplate claims to be production-ready. The badge is right