Technology
Datasette releases security patches after audit combining AI tools and human review
Datasette has released security updates 1.0a39 and 0.65.4 for its alpha and stable release families. Simon Willison urges operators of public-facing instances, particularly those combining public and private tables, to apply the fixes. He says reports from Sevban Dönmez prompted an extensive audit with Alex Garcia using several AI models, followed by almost a week of fixes and review. The account describes a useful verification workflow but does not explain individual vulnerabilities or their exploitability.
Editorial summary · Feed excerpt
What matters
- The security updates cover both the current alpha series and stable 0.65.x installations.
- Willison and Garcia often divided responsibility so one wrote tests demonstrating a problem and the other implemented its fix.
- Willison says model-assisted security audits will become part of their ongoing development work.
Context & caveats
- The supplied notice does not identify individual vulnerabilities, exploitation evidence or severity ratings.
Why this made the edition
A substantive first-party security notice identifies affected release families, upgrade priorities and the review process, although vulnerability details are absent.
Source material