Datasette 1.0a39 and 0.65.4 security releases

Blog · Watch/Read · (gathered 2026-09-13)

• Simon Willison announced critical security releases (1.0a39 and 0.65.4) for Datasette, urging users running public instances, particularly those with mixed public/private tables, to update immediately.
• The vulnerabilities were discovered and fixed following an extensive security audit conducted by Simon Willison and Alex Garcia, leveraging “frontier models” like Claude Fable 5.1, GPT-5.6, and GPT-6 Astra, a method they plan to integrate into all future development.
• Their audit process involved a productive split of work where one person created automated tests for an issue and the other implemented the fix, ensuring dual human review alongside AI agent analysis.
• Users of Datasette on the public web, especially those with mixed public and private tables, are strongly advised to apply these security patches (1.0a39 or 0.65.4) without delay.