Datasette 1.0a39 and 0.65.4 shipped this morning: two security patches, one for the current alpha series, one for the stable 0.65.x family. If you run a Datasette instance on the public internet and it mixes public and private tables, install them.
The interesting part sits next to the release. Sevban Dönmez started it with reports he had put together with AI assistance. Simon Willison and Alex Garcia then ran an extensive audit using Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra - and spent almost a week on the fixes afterwards.
The process is the story
Willison describes a split that Alex Garcia suggested, and it is a smart one. The two worked in a shared private repository. For most issues, one of them wrote the automated test that demonstrated the problem, and the other implemented the fix.
That puts two humans on every finding, on top of coding agents running different models. The models surface candidates, the test proves them, and separating the roles stops anyone from waving through their own mistake.
The tests themselves stay out of the public repositories for now - the usual handling for freshly closed holes. People patch first, details follow.
Willison’s conclusion doubles as an announcement: they found “some very subtle bugs”, and security audits by frontier models will be part of all Datasette development work going forward.
Why this is more than an anecdote
Datasette is not a toy. The project has run for years, maintained by a very experienced developer who writes publicly about security. When an audit still turns up subtle bugs there, that says little about Datasette and a lot about the limits of human attention on this particular class of mistake.
Then there is the choice of three models from two vendors. That is not decoration. Different models have different blind spots, and running only one means inheriting its gaps. You know the same logic from code review - except the second opinion here costs a few dollars instead of a few days.
It also lands in a week that showed the other side of the coin: Calif Research demonstrated that a team with AI help can go from bug to working exploit in about two days. Same capability, two directions. Defenders no longer get to choose whether it exists.
What you can take from it
The workflow transfers, even to small projects:
- Run more than one model, ideally from different vendors
- Confirm every finding with a test before anyone fixes anything
- Split test and fix across two people
- Patch and ship first, publish the details afterwards
The point is not that models find vulnerabilities. The point is that there is a process around them that filters out false alarms before they create work. An agent reporting twenty alleged security issues is worthless as long as nobody can tell them apart.
Sources: Datasette: September security releases, Simon Willison