Datasette ships two security releases after Simon Willison ran an audit with Claude Fable, GPT-5.6 Sol, and GPT-6 Astra

Datasette 1.0a39 and 0.65.4 shipped on 10 September 2026 with security fixes that Simon Willison, the project's author, tells operators to install now if their instance is on the public internet and mixes public and private tables. The 1.0a39 release is on the current alpha branch and 0.65.4 is a backport of selected fixes to the stable 0.65.x line, so both branches are patched on the same day.

The trigger was a set of AI-assisted vulnerability reports from an external researcher, Sevban Dönmez. Willison says that prompted a full audit run with three coding agents on different models: Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra. Willison and Alex Garcia worked from a shared private repository, and Willison says the audit was the first time Datasette had run a thorough coding-agent security review.

What is in the patches

The 1.0a39 changelog names 20 specific fixes. Table and view permission checks now respect SQLite's case-insensitive names. Viewing a full-text search index table now checks permission on the underlying table it draws from. The four sqlite_stat statistics tables are denied by default. Table schema display, ?_through= filter queries, foreign-key targets, incoming foreign-key relationships and their row counts now all check the view-table permission. Row endpoints check permissions before resolving primary keys, so an invisible primary key's existence is no longer revealed.

Other fixes cover SQL identifier escaping and HTML escaping for column names taken from untrusted database schemas, URL columns rendering links only for validated http or https URLs, Cache-Control: private, no-store on personalized responses, actor cookies respecting expire_after, restricted actors being blocked from creating API tokens, clickjacking protection on stored-query forms, case-insensitive redaction of configuration secrets, and SQLite extension loading being disabled after any extensions supplied through --load-extension have been loaded.

Willison writes that some of the automated tests have been held back from the public repository to give operators more time to upgrade before the vulnerabilities are described in detail. Datasette Cloud has already been patched.

How the audit was actually run

The most reusable part of the writeup is how the two humans split the work. Garcia and Willison worked in a shared private repository, and on most issues one of them wrote the automated test that captured the bug while the other wrote the fix. That put two humans on every issue, on top of the coding agents running on different underlying models. Several rounds of the audit looked for bugs similar to ones already found, which Willison says surfaced a significant number of extra problems.

A single-model audit and a single-reviewer commit would collapse both of those checks into one point of failure. The three-model, two-human split is a specific working pattern any team can copy on a codebase that mixes public and private data.

The team plans to keep running these audits and says the software security ecosystem has changed this year because of what frontier models and coding agents can do inside a private code review. That is a claim by Datasette about its own experience, not an independent measurement, and the item does not carry the size of the audit output or how many of the reported issues were false positives.

Source

Datasette 1.0a39 and 0.65.4 security releases on the Datasette blog, with the 1.0a39 changelog and 0.65.4 changelog listing the specific fixes. Also linked by Simon Willison on his weblog.