What security protections does Django provide out of the box, and what must you still do yourself?

What Django gives you by default:

• SQL injection — the ORM parameterises every query. You lose that protection the moment you use raw() or extra() with string formatting.
• XSS — the template engine autoescapes variables. You lose it with the |safe filter or mark_safe.
• CSRF — CsrfViewMiddleware plus {% csrf_token %} in every POST form.
• Clickjacking — XFrameOptionsMiddleware sets X-Frame-Options: DENY.
• Password storage — PBKDF2 with salting, and configurable validators.

What is still your job:

• DEBUG = False in production, and ALLOWED_HOSTS set. Leaving DEBUG on exposes settings, environment variables, and a full traceback with source.
• Keep SECRET_KEY out of the repository.
• Set SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE, and HSTS.
• Object-level authorisation. Django checks that a user may edit some order, not this order. Every candidate should say this — it is where real breaches happen.
• Rate limit login endpoints, validate uploaded files, and keep dependencies patched.

Note: Run python manage.py check --deploy. It audits most of the settings above and is an easy, concrete thing to cite.