Security and Tests

Test the security properties first. They are the ones where a bug is not an inconvenience.

A draft is not publicly visible. A stranger cannot edit someone else's record. A signed-out visitor is redirected rather than shown the form. The API does not return what the pages hide.

Write those four, then break each rule on purpose and confirm the matching test fails. A test you have never seen fail is a test you have no reason to trust.

The security pass. DEBUG off. Secrets from the environment, never in git. ALLOWED_HOSTS set. check --deploy clean or every warning explained. Then grep your own code: every |safe, every csrf_exempt, every raw SQL string built by formatting, every as on outside data in TypeScript. Each needs a reason or removal.

If a secret ever reached a public repository, rotate it. Deleting the commit does not help.