Datasette developers Simon Willison, Sevban Dönmez, and Alex Garcia have released security patches for versions 1.0a39 and 0.65.4 to address vulnerabilities in instances mixing public and private data. The team deployed these updates after running an extensive audit using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra, which identified subtle bugs that could compromise server security.
This process marks a shift in how open-source projects integrate artificial intelligence into their development workflows. By combining automated testing with human review, the team ensured that each fix was verified by both coding agents and separate developers. This approach reduces the risk of oversight while maintaining high standards for code quality.
- Updates apply specifically to public-facing instances with mixed data tables.
- Future development will include regular audits by frontier AI models.
- Fixes were split between humans and agents to ensure dual verification.
Source Read original →
