Voices
Willison and Alex Garcia ship Datasette security releases from their first frontier-model code audit, using three models
Datasette 1.0a39 and 0.65.4 (September 11) close permission and escaping holes across table, view and search endpoints, mostly affecting public instances that give authenticated users access to private data. AI-assisted reports from Sevban Dönmez prompted the team's first full coding-agent audit, run with Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra, followed by almost a week of human review of the fixes. They are withholding some automated tests from the public repo to give users upgrade time, and say frontier-model security audits are now part of all their development work.
↳ Follow the thread