Datasette Apps: Host custom HTML applications inside Datasette
Datasette Apps is a new plugin that lets users host custom HTML+JavaScript apps inside Datasette in a sandboxed iframe with a Content Security Policy. The apps can run read-only SQL queries and optionally write data via stored queries. The feature supports AI-assisted creation through copyable prompts for LLMs.
Background
- **Simon Willison** created **Datasette**, an open-source tool for publishing and exploring SQLite databases.
- **Datasette Apps** is a new plugin that lets users embed custom HTML+JavaScript apps inside Datasette. These run in a locked-down iframe sandbox (no cookies, localStorage, or outside network access), preventing data theft.
- Apps can run read-only SQL queries against the database, and with configured "stored queries" can also perform limited writes — turning Datasette from a read-only browser into a platform for interactive data tools.
- Inspired by **Claude Artifacts** (self-contained HTML apps generated by Anthropic's Claude) and Willison's own "vibe-coded" HTML tools collection.
- Includes a copyable prompt so users can describe an app to an LLM and have it generate the code automatically.
- AI-assisted security review caught a vulnerability: low-privilege users could whitelist external domains to exfiltrate data. Fixed by restricting domain allow-listing to trusted staff.