 <p>It's as insecure as the Django test server itself, for starters, like the above answer said -- that is, it's not tested for any sort of security the way a "production-ready" server like CherryPy would be. As a result, there could be all sorts of lurking security issues with users accessing files they shouldn't be able to; while these are generally fixed they're not considered "priority" as they would be with a production server, and no one's really banging on it looking for these things. </p> <p>Furthermore, see this summer's <a href="http://www.djangoproject.com/weblog/2009/jul/28/security/" rel="nofollow noreferrer">Django security update</a> that fixed a situation where a maliciously-crafted URL could give a visitor access to any file the Django user could see, even if it wasn't under the static root. It's fixed, but should give you an idea about why you should use a Real Server in production settings.</p>