Datasette Patches Bugs Three AI Models Found in Its Own Code

Datasette shipped security fixes to two release branches at once on Sept. 11 after a researcher's bug reports pushed its maintainers to run three separate large language models against their own codebase looking for more.

Datasette creator Simon Willison wrote up the releases, version 1.0a39 on the alpha branch and 0.65.4 backported to the older stable series, and said instances on the public internet "should upgrade now," especially ones running authentication plugins that mix public and private tables on the same server.

What started it

The trigger was a run of AI-assisted vulnerability reports from a researcher going by Sevban Dönmez, on GitHub as jankesec. That prompted what the official Datasette blog post calls the project's first full coding-agent security audit: Willison and collaborator Alex Garcia turned three models, Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra, loose on the code over several rounds, working in a shared private repository so that, as Garcia put it, "one of us would create the automated tests highlighting the issue, then the other would implement the fix," keeping two human reviewers on every finding in addition to whatever the models flagged.

What actually got fixed

The 1.0a39 release notes list 17 separate entries under Security Fixes alone, including permission checks that now respect SQLite's case-insensitive table names, a fix so that full-text search indexes can't be read without permission on the table they draw from, and a new default that denies access to SQLite's internal statistics tables. A separate change gives db.execute_write() a default 2,000-millisecond execution limit, tracked as issue #2887.

Release	Branch	Security fixes listed
1.0a39	Alpha (main)	17
0.65.4	Stable 0.65.x	6

The 0.65.4 backport carries a shorter list of six, the fixes the team judged serious enough to bring to the older branch: the same case-insensitive permission check, a fix requiring permission on the intermediate table behind a ?_through= filter, corrected SQL identifier escaping for primary-key columns pulled from untrusted schemas, and a rule that disables loading further SQLite extensions once any have been loaded with --load-extension.

Who did what

Contributor	Role	Contribution
Sevban Dönmez	External researcher (jankesec)	Submitted the initial AI-assisted vulnerability reports
Alex Garcia	Datasette collaborator	Co-ran the model audit, wrote or implemented fixes
Simon Willison	Datasette creator	Co-ran the audit, published the write-up

Willison's post says some of the automated tests written for the vulnerabilities found are being held back from publication, to give self-hosted operators time to upgrade before the exact reproduction steps are public. Neither post says how many of the fixes came directly from the three models' output versus from Willison and Garcia's own review, and Willison did not publish version numbers for the three models beyond their names.

Why the split matters for anyone running it

Datasette is built to be self-hosted, which means a self-hosted instance only gets patched if whoever runs it actually updates it, the same dependency the password-manager fork ChiPass is built around. OpenClaw's maintainers described a related strain of running an open-source project at scale with limited reviewer time, though their flood was fake pull requests rather than a security backlog. A stable-branch user who skips 0.65.4 keeps six known holes open; an alpha user on anything before 1.0a39 keeps all 17. The project has not said when 1.0a39's fixes will reach a numbered 1.0 release, which remains in alpha after this many point releases.