> I like DRF, but I think its allow-by-default mentality is a security risk. Completely agree. But DRF is useful even if you don't use any of the serializers.

> I like DRF, but I think its allow-by-default mentality is a security risk. Completely agree. But DRF is useful even if you don't use any of the serializers. E.g. you can just use it to handle auth, requests, and responses, and then validate things by hand and save them directly to the Django model. You still pretty much need serializers when validating image files because you can't trigger the Django code to do this by saving to the model directly, but for everything else it's often more readable just to serialize and deserialize by hand.