Python · Django

Django rules for Cursor

ORM, migration and settings rules that keep generated Django code safe and fast.

The rule

Save as .cursor/rules/django.mdc. Cursor picks it up on the next request.

.cursor/rules/django.mdc

---
description: Django project conventions
globs: **/*.py, **/templates/**/*.html
alwaysApply: false
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.

How Cursor loads this rule

Read from the frontmatter above, per Cursor's rules documentation.

  • alwaysApply: false with globs: **/*.py, **/templates/**/*.html: attached automatically when a matching file is in context.
  • Keep the .mdc extension. A plain .md file in .cursor/rules is ignored by the rules system.
  • Prefer to generate your own? Type /create-rule in Agent and describe what you want; Cursor saves the file to .cursor/rules.
  • Team Rules come first, then Project Rules like this one, then User Rules. Earlier sources win when guidance conflicts.

Cursor rules setup guideCursor Team RulesLet Cursor run commands without asking

Django rules for Claude Code, Copilot, Kiro and other agents

The same instructions work as plain Markdown in AGENTS.md, which Codex, Gemini CLI, GitHub Copilot and most other coding agents read.

AGENTS.md (section)

## Django

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Claude Code.claude/rules/django.md

.claude/rules/django.md

---
paths:
  - "**/*.py"
  - "**/templates/**/*.html"
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for GitHub Copilot.github/instructions/django.instructions.md

.github/instructions/django.instructions.md

---
applyTo: "**/*.py,**/templates/**/*.html"
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Kiro.kiro/steering/django.md

.kiro/steering/django.md

---
inclusion: fileMatch
fileMatchPattern: ["**/*.py", "**/templates/**/*.html"]
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Antigravity.agents/rules/django.md

.agents/rules/django.md

---
trigger: glob
globs: "**/*.py, **/templates/**/*.html"
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Devin Desktop (Windsurf).devin/rules/django.md

.devin/rules/django.md

---
trigger: glob
globs: **/*.py, **/templates/**/*.html
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Cline.clinerules/django.md

.clinerules/django.md

---
paths:
  - "**/*.py"
  - "**/templates/**/*.html"
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.
Django rules for Continue.continue/rules/django.md

.continue/rules/django.md

---
name: "django"
globs: ["**/*.py", "**/templates/**/*.html"]
---

- Change models, then run makemigrations and commit the generated migration. Never edit a migration that has already been applied.
- Avoid N+1 queries: use select_related for foreign keys and prefetch_related for many-to-many and reverse relations.
- Validate input with forms, ModelForms or serializers, never by reading request.POST directly.
- Use get_object_or_404 in views and reverse() or {% url %} for links; never hard-code URLs.
- Reference the user model with settings.AUTH_USER_MODEL or get_user_model(), not django.contrib.auth.models.User.
- Use timezone.now(), not datetime.now(), and wrap multi-step writes in transaction.atomic().
- Read secrets and DEBUG from environment variables; never commit SECRET_KEY or set DEBUG = True for production.
- Keep CSRF protection on; do not add csrf_exempt to make a form work.
- Write tests with django.test.TestCase and run manage.py test (or pytest) before finishing.

Edit this rule and convert it for 11 agents →

More templates

Next.js App RouterTypeScript (strict)React componentsPythonFastAPIFastifyNode.js and ExpressGoRustData science notebooks and pipelinesTesting disciplineSecurity guardrailsVue 3 (Composition API)NuxtSvelteKit (Svelte 5 runes)Angular (standalone components, signals)LaravelRuby on RailsNestJSSpring BootASP.NET CoreFlutterSwiftUI (iOS)Android (Kotlin, Jetpack Compose)React Native (Expo)Tailwind CSS (v4)Prisma ORM

Get Cursor rules and settings changes by email

When Cursor changes how rules, run modes or settings work, we update these templates from the docs and send a short note. One email a week at most.

Reviewed Oct 20, 2026. Written by AgentAtlas. Adapt it to your codebase before relying on it.