LoginSign Up
← Back to all sparks
D

Django CRM

CRM
Velocity5.0

Open-source multi-tenant CRM for startups and enterprises built with Django and SvelteKit, designed for self-hosting

github.com/micropyramid/django-crm ↗

Django CRM spends a morning hardening itself against abusive input.

crmopen-sourcesecurity hardeninginput limitsdjango
◆Current state
Django CRM is an open-source CRM whose first three tracked releases all landed on October 15. Each adds a guardrail: an upload size limit, a 200-ID cap on bulk update and delete, and RE2 for regex routing conditions to block catastrophic backtracking. None changes what users can do; all limit how the app can be overloaded.
◆Where it's heading
The work points at resource exhaustion from inputs: large files, oversized bulk requests and pathological regexes. Three releases in under five hours from one contributor reads as a deliberate hardening pass rather than routine upkeep.
◆Prediction
More limits on remaining input paths are the most likely next releases. With only three entries, all from one day, the feature roadmap is not visible.

◆Recent moves

  1. 5h ago

    Django CRM moves routing regex to RE2 to stop backtracking

    Routing rules now evaluate regex conditions with RE2, which removes the catastrophic-backtracking risk of user-written patterns. It is the third guardrail of the day and is invisible unless someone writes a pathological regex.

    View source ↗
  2. 5h ago

    Django CRM caps bulk update and delete at 200 records

    Bulk update and delete actions are now capped at 200 IDs per request. Together with the upload limit hours earlier, it bounds how much work a single request can trigger.

    View source ↗
  3. 10h ago

    Django CRM enforces an upload size limit

    An upload size limit now protects the server from memory overload. It opens a same-day run of input guardrails rather than adding anything users would see.

    View source ↗