Datasette 1.0a39 and 0.65.4 security releases

Datasette maintainers Simon Willison and Alex Garcia shipped two security patches, versions 1.0a39 and 0.65.4, after running an audit that used three different frontier models, Claude Fable 5.1, GPT-5.6, and GPT-6 Astra, to look for vulnerabilities the human maintainers might have missed. Rather than trusting any single model's findings, the pair split the fix work: one person wrote a failing test that reproduced each issue before any code changed, and the other implemented the fix against that test, a division of labor meant to catch a model hallucinating a vulnerability or missing a real one. The process is a concrete example of how experienced engineers are folding multiple LLMs into a security workflow without lowering their own verification bar, using models to widen the search for problems while keeping a human authored test as the actual proof that a fix works. For teams maintaining widely used open source tools, it is a workable template. Use a multi model audit for coverage, then paired human verification for confidence before shipping.