Datasette 1.0a39 and 0.65.4 security releases

Datasette released versions 1.0a39 and 0.65.4 to patch security flaws found in an audit run with Claude Fable 5.1, GPT-5.6, and GPT-6 Astra, according to the project's release notes. The audit was prompted by issues reported by Sevban Dönmez, and Datasette creator Simon Willison said he and Alex Garcia spent almost a week reviewing and fixing the bugs, with one person writing automated tests and the other implementing each fix. Willison said security audits by frontier models will be incorporated into all future Datasette development work, and urged anyone running a public Datasette instance that mixes public and private tables to apply the fixes.

Datasette 1.0a39 and 0.65.4 security releases https://datasette.io/blog/2026/september-security-releases/ These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues reported by Sevban Dönmez https://github.com/jankesec , Alex Garcia https://alexgarcia.xyz and I ran an extensive audit of Datasette using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. We then spent almost a week collaborating on and reviewing the fixes. They helped find some very subtle bugs. We'll be incorporating security audits by frontier models into all of our development work going forward. Alex came up with a way of splitting the work which I found extremely productive: Alex Garcia and I worked together running and then responding to the audit, working in a shared private repository. For most of the issues we split the work: one of us would create the automated tests highlighting the issue, then the other would implement the fix. This ensured that two separate humans had eyes on each of the issues, in addition to our coding agents running different models. Tags: releases https://simonwillison.net/tags/releases , security https://simonwillison.net/tags/security , ai https://simonwillison.net/tags/ai , datasette https://simonwillison.net/tags/datasette , generative-ai https://simonwillison.net/tags/generative-ai , llms https://simonwillison.net/tags/llms , agentic-engineering https://simonwillison.net/tags/agentic-engineering , ai-security-research https://simonwillison.net/tags/ai-security-research