{
  "id": 6697947,
  "title": "Datasette 1.0a39 and 0.65.4 security releases",
  "url": "https://urgent.news/2026/09/11/datasette-1-0a39-and-0-65-4-security-releases",
  "topic": "culture",
  "section": "Culture",
  "published": "2026-09-11T03:27:16.000Z",
  "source": {
    "name": "Simon Willison",
    "slug": "simon-willison",
    "url": "https://simonwillison.net/2026/Sep/11/datasette-security/"
  },
  "original_language": "en",
  "account": "Datasette, a web application designed for querying SQLite databases, has released two new security patch versions: 1.0a39 for its alpha series and 0.65.4 for its stable 0.65.x family. These updates address critical vulnerabilities, particularly for instances that handle both public and private tables. The security fixes were discovered following a thorough audit performed by Sevban Dönmez and Alex Garcia, using advanced AI models such as Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. The audit process involved extensive collaboration between the developers, ensuring a comprehensive review of the identified bugs. The developers plan to integrate such security audits using frontier models into their development workflow moving forward. This release marks a significant step in enhancing the security of Datasette instances, especially for those exposed to the public web.",
  "summary": "Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues…",
  "key_points": [
    "Datasette releases security patches 1.0a39 and 0.65.4",
    "Critical vulnerabilities addressed by security fixes",
    "Audited by Sevban Dönmez and Alex Garcia using AI models"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}