Datasette Apps: host custom HTML applications inside Datasette

Simon Willison’s Datasette Apps hosts self-contained HTML/JS apps sandboxed in an iframe with no cookies and a CSP blocking outbound requests. Claude Fable 5 ran a security review before suspension and found the hole: a user could exfiltrate every table via an allow-listed host.