Datasette today published two security patch releases: 1.0a39 for the alpha series and 0.65.4 for the stable 0.65.x family. These updates are security fixes that should be applied by operators running Datasette instances on the public web — in particular if an instance serves both public and private tables.
What happened and why it matters
The fixes follow reports from Sevban Dönmez and Alex Garcia and an extensive audit conducted by the project maintainer using generative language models Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. The team then spent almost a week collaborating on implementing and reviewing the fixes. The audit uncovered several very subtle bugs that could pose risks for public-facing deployments, especially those mixing public and private data.
How the team worked
Alex Garcia and the project maintainer ran and responded to the audit within a shared private repository. For most issues they adopted a split workflow: one person wrote automated tests that demonstrated the problem, and the other implemented the fix. This approach ensured each issue was examined by two humans in addition to the model-assisted agents used during the audit.
Next steps
The Datasette team said it will incorporate security audits performed by frontier models into its regular development work going forward, making model-assisted security review a more consistent part of the project’s process.
Affected releases and recommendations
- Fixed releases: 1.0a39 (alpha) and 0.65.4 (stable 0.65.x).
- Recommendation: apply these updates if you run a Datasette instance on the public web, especially when the instance serves a mix of public and private tables.
The announcement did not include detailed technical notes in the brief release message; operators are advised to install the patches to reduce potential exposure.
