Avoid AllowAny as DRF default permission

#Metadata

Rule ID

py.security.drf-allow-any-default

Severity

high

Confidence

0.85

Languages

python

Presets

security, strict

Stability

stable

Applies to

block

Tags

authorization, django, drf, python, rules-catalog, security

#Why it matters

Default `AllowAny` exposes mutation-heavy APIs unless every view overrides permissions explicitly.

#Remediation

Prefer `IsAuthenticated` or another restrictive default, then opt-in public access only where documented.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/python/py.security.drf-allow-any-default.rule.yaml.