Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users
Impact This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords). The /-/api API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Patches Datasette 1.0a4 has a fix for this issue. Workarounds To work around …