BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//talks.python-summit.ch//swiss-python-summit-2026//speak
 er//SCZCQD
BEGIN:VTIMEZONE
TZID:Europe/Zurich
BEGIN:DAYLIGHT
DTSTART:20251022T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:How to make Django insecure - Gaweng Tan
DTSTART;TZID=Europe/Zurich:20261022T102000
DTEND;TZID=Europe/Zurich:20261022T105000
DTSTAMP:20261111T040114Z
UID:pretalx-swiss-python-summit-2026-FM9WWJ@talks.python-summit.ch
DESCRIPTION:Django is one of the most security-conscious web frameworks in
  any language. SQL injection\, cross-site scripting\, CSRF\, password hash
 ing — Django handles all of it out of the box\, often before you even kn
 ow the attack exists. But what does Django actually *do*? And what happens
  when you — accidentally or on purpose — turn those protections off?\n
 \nThis talk walks through the OWASP by doing everything wrong first. For e
 ach vulnerability\, I'll show you the insecure version — the f-string in
  a raw SQL query\, the `|safe` on user input\, the `@csrf_exempt` on a mon
 ey transfer\, the `DEBUG = True` in production — and then open Django's 
 source code to show you exactly how the framework prevents it. Not as a bl
 ack box\, but line by line: how the ORM keeps parameters separate from SQL
 \, how the template engine escapes every variable\, how the CSRF middlewar
 e validates tokens\, and why Django hashes your passwords 870\,000 times.
 \n\nBy the end you'll know where Django protects you\, where it can't\, an
 d what one management command to run before every deployment.
LOCATION:Aula 4.101
URL:https://talks.python-summit.ch/swiss-python-summit-2026/talk/FM9WWJ/
END:VEVENT
END:VCALENDAR