Datasette's Security Patch Shows What an AI-Run Audit Actually Looks Like

Datasette, the open-source tool for publishing and exploring SQLite databases, put out two security releases on the same day: 1.0a39 for the alpha line and 0.65.4 for the stable branch. Maintainer Simon Willison was direct about who should care: anyone running a Datasette instance on the public internet, especially one that mixes public and private tables behind an authentication layer.

What actually broke

The 1.0a39 changelog reads like a tour of the places permission checks quietly fall apart in a system built around dynamic SQL. Table and view permission checks weren't accounting for SQLite's case-insensitive naming. Full-text-search index tables could be queried without permission to view the source table they indexed. The internal sqlite_stat1–sqlite_stat4 tables — metadata SQLite keeps for its query planner — weren't denied by default, which matters because that metadata can leak information about a private table's contents and structure. ?_through= filters and foreign-key lookups could resolve relationships through tables a user wasn't supposed to see at all.

None of these are dramatic on their own. Each is a narrow seam where a permission check that guards the obvious path — "can this user view this table" — doesn't get re-applied on a secondary path into the same data: a stats table, a search index, a joined foreign key. That's the general shape of a permission bug in any system with more than one way to reach the same row, which is most systems with joins, caches, or derived views.

The audit process is the more interesting part

The fixes started from two independent reports — one from Sevban Dönmez, one from Alex Garcia. From there, Willison and Garcia ran what they described as an extensive audit using three different frontier models — Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra — then spent close to a week collaborating on and reviewing the resulting fixes. Willison and Garcia split the work so one person wrote automated tests for an issue while the other implemented the fix, meaning every bug had two separate humans plus multiple independent models look at it before it shipped.

That workflow is worth naming because it's not "ask an AI to find bugs and ship whatever it says." It's cross-vendor models as independent reviewers, human authorship of the regression tests that prove the fix actually closes the hole, and a second human on the fix itself. It's also why the team held back some of the proof-of-concept tests from the public repo — patching first, publishing exploit detail later, to give self-hosted instances time to upgrade before the exact mechanics are public.

Why builders outside the Datasette ecosystem should read the changelog anyway

• Permission logic on top of a query engine is a recurring failure class. Any product exposing SQL, GraphQL, or a query DSL over row-level or table-level permissions should assume secondary access paths — joins, search indexes, metadata endpoints, cache layers — need the same enforcement as the primary read path, not an inherited assumption of safety.
• Multi-model review catches different things than single-model review. Running Claude, GPT-5.6, and GPT-6 in parallel against the same codebase surfaced issues that two human reporters had already flagged independently — the models weren't a replacement for the reports, they were how the maintainers scaled from two known issues to a full audit.
• Disclosure timing is a separate decision from patch timing. Shipping the fix and withholding the exploit-proving tests is a deliberate, defensible middle ground between silent patching and full immediate disclosure.

If you operate any data-facing tool with mixed public/private access — which describes a lot of fintech dashboards, trading tooling with per-tenant data, and internal analytics products — the practical move is the boring one: update, and specifically check whether your own permission model has a sqlite_stat-shaped blind spot, somewhere a secondary path (search, joins, metadata, cache) reaches data the primary path correctly protects.