Question: Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing:

```
python manage.py createsuperuser

```

For example, is there a default username-password pair that someone could use to gain access to django admin?

Answer: 
Is it possible to login with default credentials
================================================

There is no default user, and [the docs](https://docs.djangoproject.com/en/2.0/ref/django-admin/#cmdoption-createsuperuser-username) state:

> 
> The username and email address for the new account can be supplied by using the --username and --email arguments on the command line. If either of those is not supplied, createsuperuser will prompt for it when running interactively.
> 
> 
> 

As such there is no default user that you could login with.

If someone can execute arbitrary commands, could I be hacked
============================================================

Yes, if someone can run the create user command they can make a new admin user and use it, but they could also run any command they like, so at that point you have already lost.
I think your question boils down to this, right?

> 
> is there a default username-password pair
> 
> 
> 

If so, the answer is "no." Here's the [documentation](https://docs.djangoproject.com/en/2.0/ref/django-admin/#createsuperuser) for `createsuperuser` 

Of course, you need to also be vigilant about the general security considerations of your web app, including authentication issues not directly related to the presence or absence of a default user. 

[This](https://www.owasp.org/index.php/Main_Page) is another great resource I suggest you look at.