> ## Content Index
> Fetch the complete content index at: https://www.frontiermodels.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Datasette patches private-data leaks after AI-assisted audit
- URL: https://www.frontiermodels.com/news/datasette-patches-private-data-leaks-after-ai-assisted-audit/
- Published: 2026-09-12T05:39:52.000Z
- Updated: 2026-09-12T05:39:52.000Z
- Description: Public-web operators should update to 0.65.4 or 1.0a39 now. One flaw let visitors test secret values in tables they could not read.
- Author: Frontier Models Desk
- Tags: News, datasette, open-source, claude, gpt, #candidate

Datasette released security updates 0.65.4 and 1.0a39 on September 11, fixing flaws that could expose information meant to stay private. The open-source tool lets people explore and publish databases on the web. Its maintainers urge public-web operators to upgrade immediately, especially where signed-in users can access private data.

One fix shows why: a visitor could use an otherwise permitted request to test a guessed value against a table they were forbidden to read. The releases follow external vulnerability reports and an audit using three AI models, with human maintainers dividing the work of testing and repairing the flaws.

A private table could still answer a question 

Datasette’s `_through` filter connects related tables. Before the fix, it could consult a forbidden table and let the results from an accessible table reveal whether a guessed secret value matched. The public patch demonstrates this yes-or-no leak, not a complete database dump. A separate caching fix addresses personalized pages potentially reaching another user through a shared cache; that risk depends on the deployment’s caching setup.

The [filter patch and regression test](https://github.com/simonw/datasette/commit/577aeb73f06ec48df630e75af47713bf029fc0c8?ref=frontiermodels.com) make the permission failure concrete. The test denies an anonymous visitor access to a salaries table, then attempts to use that table in a filter. The repaired request receives a 403 permission-denied response. Blocking direct access to a table was insufficient when another feature could still consult it.

Both release branches fix that problem, along with permission checks that failed to account properly for SQLite’s case-insensitive table and view names. The [stable 0.65.4 changelog](https://docs.datasette.io/en/stable/changelog.html?ref=frontiermodels.com) also lists repairs to SQL construction involving untrusted database schemas, full-text search detection, caching and extension loading. The [1.0a39 alpha](https://docs.datasette.io/en/latest/changelog.html?ref=frontiermodels.com) covers a broader set of interfaces, including schema displays, relationships between tables, write APIs, authentication cookies and API-token creation. Those additional alpha fixes should not be read as a list of flaws affecting stable installations.

The caching change protects another part of the same privacy boundary. The [patch](https://github.com/simonw/datasette/commit/910636e9ac6f632c5df8647b8b2fe661e3674c5c?ref=frontiermodels.com) marks personalized dynamic responses `Cache-Control: private, no-store`, telling compliant caches not to store them. Anonymous dynamic responses now carry `Vary: Cookie, Authorization`, so caches account for those request headers when choosing a response. Whether an older deployment actually exposed a personalized page depends on its proxy or content delivery network and how that system handled caching.

The project’s [upgrade-now recommendation](https://datasette.io/blog/2026/september-security-releases?ref=frontiermodels.com) is clear even though the changelogs do not give every fix a severity rating or affected-version range. The available evidence does not establish exploitation of the filter flaw against a deployed instance or an actual cache disclosure. Datasette says its hosted Cloud service already has the fixes. For operators managing their own installations, the supported response is:

1. Upgrade the existing release branch to at least 0.65.4 for stable installations or 1.0a39 for alpha installations, using the appropriate method in the [installation documentation](https://docs.datasette.io/en/stable/installation.html?ref=frontiermodels.com).
2. Redeploy or restart the service with the updated package.
3. Verify the version in the running deployment with `datasette --version`.
4. Check dynamic responses through the actual proxy or content delivery network: personalized responses should carry `private, no-store`, and anonymous responses should vary by `Cookie` and `Authorization`.

Those checks establish the new behavior. They cannot tell an operator whether older personalized responses were previously stored.

The AI contribution is worth examining because it produced a concrete maintenance workflow. According to Simon Willison’s release account, Sevban Dönmez submitted several AI-assisted vulnerability reports, prompting repeated audits with Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra. The team searched for related problems after initial findings, expanding the review beyond the originally reported bugs.

Willison and Alex Garcia then split responsibilities for most issues: one created automated tests demonstrating the problem, and the other implemented the repair. The [release’s commit history](https://github.com/simonw/datasette/commits/1.0a39/?ref=frontiermodels.com) records their security changes. The maintainers say they withheld some tests to give operators time to update before publishing more revealing details.

That account documents model use, but it cannot tell us which model discovered which vulnerability, or where an initial suggestion became a finding through human analysis. Public records lack finding-by-finding attribution and model outputs; human commit authorship does not resolve that distinction. Our read is that the useful example here is the division of labor: AI-assisted searching followed by reproducible tests and a second human reviewing the repair. Operators should act on the released fixes now; claims about which model deserves the credit need more evidence.