# Datasette 1.0a39 and 0.65.4 security releases

DevFeed: [Datasette 1.0a39 and 0.65.4 security releases](<https://devfeed.tech/articles/datasette-1-0a39-and-0-65-4-security-releases-31163.md>)

Original publisher: [Read original article](<https://simonwillison.net/2026/Sep/11/datasette-security/>)

Author: Simon Willison

Published: 2026-09-11T03:27:16Z

Content type: release

Language: en

Sources: [Simon Willison's Weblog](<https://devfeed.tech/sources/simon-willison-s-weblog.md>)

Topics: [releases](<https://devfeed.tech/topics/releases.md>), [Security](<https://devfeed.tech/topics/security.md>), [audit](<https://devfeed.tech/topics/audit.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [ai security](<https://devfeed.tech/topics/ai-security.md>), [agentic-engineering](<https://devfeed.tech/topics/agentic-engineering.md>), [Generative AI](<https://devfeed.tech/topics/generative-ai.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [gpt-6-astra](<https://devfeed.tech/topics/gpt-6-astra.md>)

Tags: [agentic-engineering](<https://devfeed.tech/tags/agentic-engineering.md>), [agentic-engineering-63](<https://devfeed.tech/tags/agentic-engineering-63.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-2-236](<https://devfeed.tech/tags/ai-2-236.md>), [ai-security-research](<https://devfeed.tech/tags/ai-security-research.md>), [ai-security-research-42](<https://devfeed.tech/tags/ai-security-research-42.md>), [coding-agents](<https://devfeed.tech/tags/coding-agents.md>), [datasette](<https://devfeed.tech/tags/datasette.md>), [datasette-1-542](<https://devfeed.tech/tags/datasette-1-542.md>), [generative-ai](<https://devfeed.tech/tags/generative-ai.md>), [generative-ai-1-982](<https://devfeed.tech/tags/generative-ai-1-982.md>), [llms](<https://devfeed.tech/tags/llms.md>), [llms-1-948](<https://devfeed.tech/tags/llms-1-948.md>), [releases](<https://devfeed.tech/tags/releases.md>), [releases-31](<https://devfeed.tech/tags/releases-31.md>), [security](<https://devfeed.tech/tags/security.md>), [security-634](<https://devfeed.tech/tags/security-634.md>), [tests](<https://devfeed.tech/tags/tests.md>)

## AI overview

Datasette 1.0a39 and 0.65.4 are security patch releases for the alpha and stable series. They address issues found during an extensive audit, including instances that mix public and private tables. The audit used Claude Fable 5.1, GPT-5.6, and GPT-6 Astra alongside human review and automated tests.

## Source excerpt

Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues reported by Sevban Dönmez, Alex Garcia and I ran an extensive audit of Datasette using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. We then spent almost a week collaborating on and reviewing the fixes. They helped find some very subtle bugs. We'll be incorporating security audits by frontier models into all of our development work going forward. Alex came up with a way of splitting the work which I found extremely productive: Alex Garcia and I worked together running and then responding to the audit, working in a shared private repository. For most of the issues we split the work: one of us would create the automated tests highlighting the issue, then the other would implement the fix. This ensured that two separate humans had eyes on each of the issues, in addition to our coding agents running different models. Tags: releases, security, ai, datasette, generative-ai, llms, agentic-engineering, ai-security-research