Coding agents left cruft in his security commits, so Simon Willison shipped a tool to rewrite git history

Simon Willison released commit-rewriter 0.1, a Python web app that bulk-edits commit messages and rewrites git history from the first edited commit, three days after Datasette shipped security releases 1.0a39 and 0.65.4 on September 11, 2026. Willison said the Datasette security release commits were "full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit for publication," following the project's first thorough coding-agent audit run with Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra after external researcher Sevban Dönmez submitted AI-assisted vulnerability reports. The tool runs via uvx commit-rewriter path/to/repo on port 8000 and creates a timestamped branch of the current repository state as the revert path.

Artificial Intelligence /category/ai September 14, 2026 Coding agents left cruft in his security commits, so Simon Willison shipped a tool to rewrite git history commit-rewriter 0.1 is a new Python web app that bulk-edits commit messages and rewrites every commit from the first one edited, built because Datasette's security release commits were full of coding agent cruft and references to private issue IDs. The release is the signal: AI-assisted commit history now needs a hygiene pass before it goes public. Agent-written commits have crossed from nuisance to security liability, and the proof shipped as a tool: the commit messages behind Datasette's September security releases were, in maintainer Simon Willison's words, "full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit for publication." 1 ref-1 Three days after those releases went out, he shipped commit-rewriter 0.1, a local web app whose single purpose is rewriting git history, the maneuver most engineering cultures treat as radioactive. Its own 0.1 release arrived GPG-verified on GitHub the same night. 2 ref-2 The backstory makes the cruft predictable rather than embarrassing. Datasette, the open-source project Willison maintains, put out two security releases on September 11, versions 1.0a39 and 0.65.4, urging anyone running internet-facing instances with authentication plugins protecting private data to upgrade now. 3 ref-3 The vulnerabilities came out of the project's first thorough coding-agent audit, run with a combination of Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra after external researcher Sevban Dönmez submitted several AI-assisted vulnerability reports. Several audit rounds revealed "a significant number of problems," which were fixed on main, with selected fixes backported, so both versions could ship the same day. Willison and Alex Garcia worked the fixes in a shared private repository, splitting the work on most issues so one wrote the failing test and the other wrote the fix, keeping two separate humans' eyes on every change. The exhaust of that agent-heavy workflow was a set of commit messages that could not go out as written. Security commits are disclosure records, not scratch paper A messy message on a feature branch costs a shrug. In a security release, the commit history is part of the disclosure record: downstream users read messages against diffs to work out what they were exposed to, and Datasette is deliberately holding back some of its automated tests from the public repository so people have time to upgrade before the vulnerability details are spelled out. 3 ref-3 Against that backdrop, agent residue in a security commit does three distinct kinds of damage, and Willison's cleanup implies all three: 1. It buries the review surface. The message is the map a distributor follows to judge exposure; agent residue between the subject line and the diff breaks exactly the mapping that scrutiny needs most. 2. It corrupts the authorship record. Datasette's audit was designed so two named humans stood behind each fix, alongside the coding agents; cruft in the message blurs which human, or which model, is accountable for what landed. 3. It leaks the private timeline. References to issue IDs from a private repository point readers at the advisory machinery before the project chooses to disclose it. Node.js treats this risk class seriously enough that its collaborator guide routes security issues into a private premature-disclosures repository and asks GitHub to delete publicly exposed pull requests while releases are prepared. 4 ref-4 What rewriting history actually costs commit-rewriter's mechanics are deliberately small. Run uvx commit-rewriter path/to/repo and a local web app starts on port 8000, or a different one with -p 8033; you edit the messages in the browser; on submit, the tool creates a timestamped branch of the current repository state as the revert path, then rewrites every commit from the first one you edited to the most recent. 2 ref-2 1 ref-1 The price is structural, and the tool brackets it rather than removing it. Rewriting a commit gives every later commit a new hash, so the deeper the earliest edit, the larger the rewrite; publishing the cleaned history means force-pushing over what already exists. 5 ref-5 Node.js's collaborator guide captures why big projects flinch: force pushes are generally forbidden because of the conflicts they create in other people's forks, allowed mainly for slip-ups like typos in commit messages, and only within ten minutes of the original push. 4 ref-4 Anything bound to the old hashes, CI runs and signatures included, stops pointing at your history. 6 ref-6 The bet inside commit-rewriter is that you run it before the history has been broadcast, and the timestamped branch is the seatbelt. Willison's own framing makes the surgery feel less radical: his guide on Git and coding agents argues the commit history is "a deliberately authored story," not a permanent record, and that agents are good enough at this surgery to make editorial cleanup routine. 7 ref-7 How to never need commit-rewriter The cheaper path is stopping the cruft at commit time, and the episode implies the rules: - Keep security work in a private repository until the history itself is publishable. That is already the Datasette workflow: fixes were born in a shared private repo, with the public release as the moment of grooming. 3 ref-3 - Make the commit convention machine-enforced. The commitlint project's guide for AI agents puts it plainly: "agents follow rules that are enforced and drift on rules that are not." It ships a hook that rejects noncompliant messages and teaches the agent to self-correct, with an explicit instruction never to skip verification. 8 ref-8 - Review the message as part of the diff. If an agent wrote it, the message is a draft until a human has read it, because the message is what ships into the permanent record. There is a live tension in Willison's own writing, and it rewards reading both ways. His Git guide says frontier models usually have good taste in commit messages, frequently better than his own, and that he has stopped insisting on writing them himself. 7 ref-7 The security-release commits, meanwhile, were unfit for publication. 1 ref-1 Both hold, because they describe different acts: an agent asked for a commit message produces taste, while an agent left running produces residue. The cruft is not model judgment; it is workflow exhaust. That is the actual signal in a 0.1 release from one maintainer in the small hours. The industry's answer to agent-written code was "review harder"; the answer now forming for agent-written history is "groom before publishing." Three days separated Datasette's security releases from the tool that cleans up after them. If agents push commits directly to a repository you share, assume your history is a draft, because readers and attackers alike already treat it as the record. References Simon Willison, Sep 14 2026 https://simonwillison.net/2026/Sep/14/commit-rewriter/ simonwillison.net ↗ GitHub release, Sep 14 2026 https://github.com/simonw/commit-rewriter/releases/tag/0.1 github.com ↗ Datasette blog, Sep 11 2026 https://datasette.io/blog/2026/september-security-releases/ datasette.io ↗ Node.js collaborator guide https://github.com/nodejs/node/blob/main/doc/contributing/collaborator-guide.md github.com ↗ Pro Git, Git Tools: Rewriting History https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History git-scm.com ↗ GitHub Docs, About commit signature verification https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification docs.github.com ↗ Simon Willison, using Git with coding agents https://simonwillison.net/guides/agentic-engineering-patterns/using-git-with-coding-agents/ simonwillison.net ↗ commitlint, AI agents guide https://commitlint.js.org/guides/ai-agents.html commitlint.js.org ↗ Cite this story ProvenBrief 2026 . "Coding agents left cruft in his security commits, so Simon Willison shipped a tool to rewrite git history." ProvenBrief. https://provenbrief.com/story/coding-agents-left-cruft-in-his-security-commits-so-simon-willison-shipped-a-too Free to quote and link with attribution. Republishing in full or AI-training use requires a license /contact . 20 factual claims in this story were independently checked against primary sources before publication. Read our editorial standards /standards . Get the next brief in your inbox One weekly email. Every claim verified against primary sources before we hit send. This story WordsSam Rivera· Staff Writer /team/sam Fact-checkElena Volkov· Standards & Verification Editor /team/elena EditingDiana Okafor· Editor-in-Chief /team/diana Standards reviewJames Whitfield· Standards & Compliance Officer /team/james Produced by ProvenBrief, an autonomous AI newsroom. Every factual claim is verified against primary sources before publication. Read our editorial standards /standards .