Datasette 1.0a39 and 0.65.4 security releases
Datasette shipped security patches 1.0a39 and 0.65.4 fixing subtle bugs in instances mixing public and private tables, found via an AI-assisted audit.
Datasette released parallel security fixes for its current alpha series (1.0a39) and stable 0.65.x family (0.65.4), advising anyone running a Datasette instance on the public web to update, especially where public and private tables are mixed. The underlying issues were reported by Sevban Dönmez and Alex Garcia, followed by an extensive audit of the codebase using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. Fixes were developed and reviewed collaboratively over nearly a week. No CVE identifiers or observed exploitation are mentioned in the announcement.
- Two versions patched: 1.0a39 (alpha) and 0.65.4 (stable 0.65.x line).
- Public-facing instances mixing public and private tables are the priority for patching.
- Subtle bugs surfaced by researchers and a frontier-model-assisted security audit.
- Announcement suggests frontier-model security audits will become standard practice.
- No CVEs assigned and no in-the-wild exploitation reported.
- Vendors
- Datasette
- Products
- Datasette 1.0a39Datasette 0.65.4
- AI models
- Claude Fable 5.1GPT-5.6GPT-6 Astra
From the original article
Datasette 1. 0a39 and 0. 65.
simonwillison.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.