 <p>The point is that your "password protection" is useless if a hacker can simply bypass that and read your database directly. We don't know if they can, but - as the docs say - the dev server has undergone <em>no</em> security testing whatsoever, so they might well be able to.</p> <p>Plus, the server is single-threaded. It will only ever be able to serve one request at a time. That makes for a very slow experience for your users.</p> <p>Seriously, there is <em>no reason</em> to do this. Setting up Apache + mod_wsgi, or whatever your preferred hosting environment is, is a five-minute process if you follow the very detailed instructions. </p>