Python Web Rules

The problem

Python web code often looks correct in development but fails under load due to N plus one queries, blocked event loops, or leaky serialization. LLMs usually write code that works in isolation but ignores production-critical details like transaction boundaries and connection pooling.

What it does

• Identifies N plus one query patterns and converts them to select_related or prefetch_related joins.
• Detects synchronous calls like requests or ORM operations inside async handlers that block the event loop.
• Enforces Pydantic v2 strictness by separating input/output models and forbidding extra fields to prevent data leaks.
• Audit settings for security vulnerabilities including missing CSRF protection, exposed secrets, and improper HSTS headers.
• Refactors database writes to use atomic boundaries and prevents external API calls from holding row locks.

Frameworks & tools

Django, FastAPI, Pydantic v2, SQLAlchemy, and standard Python async libraries.

Why this beats prompting it yourself

Generic prompts often miss the nuances of database connection lifetimes and background task safety. This skill uses a specific trigger matrix to catch silent failures, like summing columns in Python memory instead of the database, that typical AI suggestions overlook.

Use cases

• Refactoring slow Django endpoints that perform hundreds of database queries per request.
• Converting synchronous FastAPI endpoints to safe asynchronous implementations without blocking.
• Hardening API security by implementing strict Pydantic validation and secure header configurations.
• Ensuring database integrity by correctly placing transaction boundaries around multi-row writes.

Known limitations

Does not execute migrations, start servers, or access live databases. All verification steps are provided as commands for the user to run manually.