Python and Django: fix cards and security baseline

Keep django.middleware.csrf.CsrfViewMiddleware in MIDDLEWARE and do not exempt views: it checks the Origin (or, over HTTPS, the Referer) against the site and CSRF_TRUSTED_ORIGINS, and the token.

Build one queryset that holds the rule, from request.user and its tenant and role, never from request data: Invoice.objects.filter(tenant=member.tenant), narrowed to owner=user for members.

Prefer Django's LoginView, which checks next itself; add other hosts with success_url_allowed_hosts.

Resolve both paths and compare whole components: base = Path(settings.FILES_ROOT).resolve(), target = (base / name).resolve(), and return FileResponse(target.open('rb')) only if target.is_relative_to(base). resolve() collapses ../ and follows symlinks; the check also catches absolute names.

Attach the policy to the connection, not the URL string. Allow only http/https and ports 80/443 and reject credentials; resolve the host (or read an IP literal in any notation) and reject loopback, private, link-local and IPv4-mapped addresses with ipaddress; connect to the vetted IP; re-validate every redirect; cap time and bytes.

Install argon2-cffi and list django.contrib.auth.hashers.Argon2PasswordHasher first in PASSWORD_HASHERS, keeping older hashers after it.

Let Django's autoescaping work: render {{ value }} without |safe, mark_safe() or {% autoescape off %}, so < > ' " and & become entities in text and quoted attributes.

User text in a CSV is attacker-controlled. If a cell starts with = + - @, a tab, CR, LF or NUL, prefix it with an apostrophe so a spreadsheet treats it as text, then write it with csv.writer, which escapes commas, quotes and newlines.

Let the ORM build the query: Order.objects.filter(customer__name=name, status=status) sends both values as bound parameters.

Keep Django's XFrameOptionsMiddleware (X-Frame-Options defaults to DENY) and add a CSP with ContentSecurityPolicyMiddleware and SECURE_CSP = {"frame-ancestors": [CSP.NONE]}, which browsers honor over X-Frame-Options.

Decide the type from the bytes and never let the client pick the name.

Authenticate the operator, do not trust the network or a client header.

Give every ModelForm an explicit allowlist, fields = ["display_name", "bio"]: it binds only those fields and ignores the rest of the request.