Application Security11 September 2026
Datasette 1.0a39/0.65.4: A Case Study in Multi-Tenant Permission Bugs
Two patch releases close a cluster of subtle authorisation bypasses in the open-source data-publishing tool — a reminder that permission checks fail at the edges, not the middle.
datasetteauthorization-bypassopen-source-security
4 min readRead
API & Supply-Chain Security14 August 2026
Datasette's New Upload API Turns a Bearer Token Into a Production Database Swap
The datasette-upload-dbs 0.5a0 release formalises a POST API for hot-swapping a live SQLite database — a convenient CD primitive that is only as safe as the bearer token and permission scope guarding it.
api-securitydevsecopssecrets-management
4 min readRead
AI Agent Security1 August 2026
Datasette Apps' Invisible-Iframe Sandbox: A Small Blueprint for Safer Coding Agents
A niche release note from Datasette Apps shows a concrete, low-drama pattern for letting an AI agent test the code it writes without giving it a live, interactive session to abuse.
ai-agent-securityagentic-codingsandboxing
4 min readRead