Willison patches datasette-auth-github, builds iNaturalist feed from his phone
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
datasette-auth-github 1.0 simonwillison.net
Release: datasette-auth-github 1.0 I run this GitHub login plugin on the agent.datasette.io demo site and I noticed that my authenticated sessions weren’t lasting very long. It turned out that the plugin was setting cookies without a Max-Age parameter, so they were expiring at the end of a browser session (which in Mobile Safari seems to happen pretty often, independently of how you are using the app.) I fixed that in #80 and, since this plugin has been around for quite a while and is tested ag…
California Sea Lion, Brandt’s Cormorant simonwillison.net
California Sea Lion, Brandt’s Cormorant, in Pillar Point Harbor, CA, US I only noticed this after I had taken the photo: Morris the Northern Gannet is peeking out from behind the base of the sign. Tags: wildlife
References
datasette.io — Datasette Agent announcement datasette.io
Datasette Agent is an open-source AI assistant that explores SQLite databases via natural language; the demo at agent.datasette.io is gated by GitHub login to prevent abuse and currently runs on Gemini 3.1 Flash-Lite.
n1n.ai — independent walkthrough of Datasette Agent explore.n1n.ai
The agent runs an ‘agentic loop’ — inspect schema, generate SQL, execute, reflect on errors — and the hosted demo requires a GitHub sign-in before you can issue any queries.
datasette.io plugin directory — datasette-auth-github datasette.io
Restrict access to specific GitHub users, organization members or team members, configured via github_org, github_teams, and load_teams keys with client_id / client_secret supplied as environment variables.
Simon Willison — ‘Datasette Secrets’ (2024) simonwillison.net
Willison has long flagged that plugins like datasette-auth-github need a durable way to hold OAuth client secrets, motivating the datasette-secrets plugin and repeated calls for community security review of the auth code.
Bay Nature — ‘An Atlantic Bird Makes a Home in California’ baynature.org
Morris, first identified in California in April 2012, is believed to have traversed the Northwest Passage — a route through the Arctic that was historically blocked by pack ice but has become navigable due to warming temperatures.
Simon Willison — earlier Morris sighting (Aug 15 2026) simonwillison.net
Morris the Northern Gannet is peeking out from behind the base of the sign.
daily.dev summary of Teleport ‘13 engineers, 3 months’ post daily.dev
Simple, targeted prompts guided by experienced human vulnerability researchers actually outperformed sophisticated multi-agent harnesses such as Teleport’s own experimental tool, Conclave… the 13-engineer team discovered nearly double the number of high-severity vulnerabilities compared to the previous two years combined.
Simon Willison — ‘inat-sightings’ project post (May 1 2026) simonwillison.net
A Python CLI tool, inaturalist-clumper, aggregates sightings occurring within a two-hour window and a five-kilometer radius into a single ‘Sighting’ event… built almost entirely through mobile AI-assisted programming using Claude Code for web on his phone.
South Park Commons interview with Simon Willison blog.southparkcommons.com
Willison advocates for these projects as ‘self-sustainable’ side ventures… relying on public APIs and flat-file JSON storage on GitHub, he ensures that projects like his ‘Owls Near Me’ tool and the ‘Sightings’ feed require near-zero maintenance.
arXiv — GenIaC-SecBench (LLM vs human code security) arxiv.org
LLMs generate code with 3.2x to 3.9x the vulnerability density of human-authored equivalents… a study involving CyberSecEval 3 noted an unexpected lack of statistically significant improvement in speed or accuracy for human specialists when assisted by LLM copilots.
