Datasette ships security patches after an audit run with frontier models

Datasette 1.0a39 and 0.65.4 have been released as security patches for the open-source data publishing tool. Developer Simon Willison said the fixes matter above all for deployments running on the public web that mix public and private tables in the same instance. The patches follow issues reported by Sevban Dönmez and an extensive audit that Alex Garcia and Willison ran using Claude Fable 5.1, GPT-5.6 and GPT-6 Astra. The two developers spent close to a week on the fixes, splitting most of the issues so that one wrote the automated test exposing a problem and the other implemented the fix. Willison said the models found some very subtle bugs, and that frontier-model security audits will now be part of all their development work.