Datasette Apps: host custom HTML applications inside Datasette

Simon Willison on a new Datasette feature that lets you host self-contained HTML and JavaScript applications inside a Datasette instance, running read-only SQL against its databases. His demo is a timeline app over 1,953 items of news, blog posts and releases.

The interesting part is the sandboxing, since the whole point is letting users publish code that other users will run. Apps load in an <iframe sandbox="allow-scripts allow-forms"> so they get no cookies and no localStorage, and a CSP header blocks outbound requests so an app cannot phone data home. Once set, that policy is immutable for the content of the frame. The app talks to the parent through a MessageChannel(), which closes automatically if the page navigates away. Reads are allow-listed read-only queries; writes have to go through pre-configured stored queries.

He is candid about how it was built: an Opus 4.6 prototype in Claude Code, an architecture plan worked out with GPT-5.5 xhigh, then most of the implementation in Codex Desktop. In the few days he had access to Claude Fable 5 before it was suspended, he had it run a security evaluation, and it found a privilege escalation he had missed: a user with create-app permission could write an app that queried every available table and exfiltrated the results to a host they had allow-listed via CSP, so the app can now run queries as that user and steal their private data. The fix was a new apps-set-csp permission restricting allow-listing to trusted staff.

A neat illustration that the sandbox design is only as good as the permission model around it, and that a fresh model reading your work adversarially is worth the time.