Skip to content
What are you looking for?. Open searchSR
Toolsmedium signalverified

Datasette ships two security releases found by an audit its authors ran with models

Two patch versions are out, 1.0a39 for the alpha series and 0.65.4 for the stable line, and the fixes matter most for an instance on the public web that mixes public and private tables. The list is a catalog of ways a permission check can be true and still wrong: a table name in the wrong case, a filter that reaches through an intermediate table, statistics tables nobody thought to deny. The audit that found them was run with Claude Fable 5.1, GPT-5.6 and GPT-6 Astra, and reviewed by two people over almost a week.

By Redakcija WebAiRadarPublished 2 min readwritten by a model

Source

Datasette 1.0a39 and 0.65.4 security releases

Simon Willison’s Weblog · Original published September 11, 2026

Datasette publishes a SQLite database as a browsable website, and plugins decide who may see which table. Both supported lines received a security release: 1.0a39 on the alpha series and 0.65.4 on the stable 0.65 family. The advice attached to them is narrow and clear — upgrade if the instance is on the public web, and especially if authentication is what keeps part of it private. The Datasette Cloud deployment has the fixes already.

Where the permission check was true and still wrong

Almost every fix in the release is an access-control fix rather than a crash. In each case a rule existed, the code asked for it, and the answer was still yes for something the operator meant to keep private. That is the failure mode of an authorization layer built table by table, and it is why the advisory singles out instances that mix public and private data.

  • Table and view permission checks now account for SQLite's case-insensitive names, so the same table spelled in another case is no longer a different object.
  • A filter that uses ?_through= now requires permission for the intermediate table it travels through.
  • The statistics tables sqlite_stat1 through sqlite_stat4 are denied by default, and schema display, foreign-key APIs and row endpoints now check view-table before they resolve anything.
  • Identifier escaping was fixed for column names coming from an untrusted schema, in SQL and in HTML, and a URL column is rendered as a link only for a validated HTTP or HTTPS address.
  • Private responses are sent with a header that forbids caching, actor cookies respect their expiry setting, a restricted actor can no longer mint an API token, and extension loading is switched off once the extensions given on the command line have loaded.

The audit was run with models, reviewed by people

Simon Willison and Alex Garcia ran the audit after issues reported by Sevban Dönmez, using Claude Fable 5.1, GPT-5.6 and GPT-6 Astra in a shared private repository. They then spent almost a week on the fixes. Willison writes that the models found subtle bugs, and that audits of this kind will be part of the project's development work from now on.

The way the work was split is the part worth copying. For most issues, one person wrote the automated test that demonstrated the problem and the other wrote the fix, so two humans looked at every finding in addition to the agents. Some of the tests are being held back from the public repository to give operators time to upgrade before the details are spelled out.

„We'll be incorporating security audits by frontier models into all of our development work“
Simon Willison
TagssecurityOpen sourceauditAgentic codingDatasette

Related

PYTHON3.15UTF-8 by default and lazy imports
Toolsmedium signal

Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports

Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.

Python Software Foundationverified

An archival index card with a typed caption and a black-and-white photograph of workers on a ship's deck handling a buoy and its anchor chain, laid over beige graph paper and a red table of figures.
Toolsmedium signal

Anthropic's OSS Scanner sends open-source maintainers free vulnerability reports that no human has reviewed

Anthropic launched OSS Scanner on October 8, 2026, an opt-in service that scans eligible open-source projects with its strongest models, including Claude Mythos, at no cost. Each report includes a reproducer, an explanation, and a candidate patch when one exists, but no person checks it before it is sent. Anthropic says it expects more than 90% of findings to be real.

Anthropicverified