SecureDrop
@securedrop.org
An open-source whistleblower submission system (https://securedrop.org/) — a project of @freedom.press
"It could be as significant an upgrade as HTTPS." A nice explainer of WEBCAT, our project to make JavaScript tamper-proof and the web a safer place for everyone:
Verifiable Web Code — Why It's So Exciting
Browsers are beginning to be able to guarantee that the code running on a page is actually the code its developers published — no silent tampering, no trusting the server. We think the payoff is huge:
blog.siv.org
SecureDrop Workstation 1.8.0 and SecureDrop Inbox 1.5.0 are now available! These releases add support for Debian 13 “trixie” and automatically upgrade the underlying VMs.
SecureDrop Workstation 1.8.0 released
These releases add support for Debian 13 “trixie” and automatically upgrade the underlying VMs
securedrop.org
SecureDrop 2.16.1, which fixes a low-severity security issue, is now available. If your instance was affected, administrators will need to take manual action to rotate credentials.
Advisory: SecureDrop 2.16.1 released
SecureDrop 2.16.1, which fixes a low-severity security issue, is now available.
securedrop.org
SecureDrop 2.16.0 is now available, with a number of improvements to APIv2, and a fix for a low-severity security vulnerability:
SecureDrop 2.16.0 released
This release includes a number of improvements to APIv2, and a fix for a low-severity security vulnerability
securedrop.org
Qubes 4.2 is now end-of-life. All SecureDrop Workstation users should be using Qubes 4.3. If you have not upgraded, please contact support immediately.
Qubes 4.2 is end-of-life
All SecureDrop Workstation users should be using Qubes 4.3. If you have not upgraded, please contact support immediately
securedrop.org
SecureDrop Inbox 1.4.0 is now available! This release fixes a number of accessibility-related issues and fully removes the legacy client package:
SecureDrop Inbox 1.4.0 released
This release fully removes the legacy client package and fixes a number of accessibility-related issues.
securedrop.org
SecureDrop Inbox 1.3.2 is now available! This update adds warnings and safeguards when deleting large numbers of sources.
SecureDrop Inbox 1.3.2 released
SecureDrop Inbox 1.3.2 has been released to add extra warnings and safeguards when deleting large numbers of sources
securedrop.org
SecureDrop Workstation 1.6.2, for Qubes 4.2, and 1.7.1, for Qubes 4.3, are now available! These releases remove the legacy SecureDrop Client and enable an upgrade script to make preparing for the Qubes 4.3 upgrade simpler.
SecureDrop Workstation 1.6.2 and 1.7.1 released
These releases remove the legacy SecureDrop Client and enable an upgrade script to make preparing for the Qubes 4.3 upgrade simpler
securedrop.org
SecureDrop Inbox 1.3.1 is now available! This release fixes a low-priority security issue in the securedrop-proxy component.
SecureDrop Inbox 1.3.1 released
SecureDrop Inbox 1.3.1 has been released to address a low-priority security issue in the securedrop-proxy component
securedrop.org
SecureDrop Client, which has been replaced by SecureDrop Inbox, is now end-of-life.
SecureDrop Client is end-of-life
The SecureDrop Client will not receive any further updates, and will be removed in a forthcoming Workstation release
securedrop.org
SecureDrop Workstation 1.6.1 is now available, allowing administrators to begin the process of upgrading to Qubes 4.3.
Qubes 4.3 upgrade available for SecureDrop Workstation
Release enables Qubes 4.3 upgrade and prepares foundation for improved speed and security when processing submissions
securedrop.org
SecureDrop Inbox 1.3.0 is now available! This release adds a label to show the number of selected sources, disables downloading of files in offline mode, and updates a number of dependencies. securedrop.org/news/secured...
SecureDrop Inbox 1.3.0 released
This release adds a label to show the number of selected sources, disables downloading of files in offline mode, and updates a number of dependencies
securedrop.org
We're grateful to @torproject.org and @fundingcommons.bsky.social for including us in this crowdfunding campaign alongside nine other cool projects as a new way to fund internet freedom!
SecureDrop. Tor × FTC Quadratic Funding
Anonymous whistleblowing submission system for journalists and sources
internetfreedom.torproject.org
SecureDrop Workstation 1.7.0 has been released! This is a Qubes 4.3-only release, and takes advantage of some of its new features to provide a more robust and secure way for journalists to review submissions.
SecureDrop Workstation 1.7.0 released
This is a Qubes 4.3-only release, and takes advantage of some of its new features to provide a more robust and secure way for journalists to review submissions
securedrop.org
SecureDrop Inbox 1.2.0 is now available! This release increases the number of results returned by search, improves file handling and sync performance, and carries out other internal cleanup.
SecureDrop Inbox 1.2.0 released
This release increases the number of results returned by search, improves file handling and sync performance, and carries out other internal cleanup
securedrop.org
SecureDrop Inbox 1.1.0 is now available! This version fixes a number of small issues that didn’t make it into the previous release.
SecureDrop Inbox 1.1.0 released
This version fixes a number of small issues that didn’t make it into the previous release.
securedrop.org
The inaugural release of SecureDrop Inbox is now available! 🎉 The Inbox is a full rewrite of our client, and includes many new features and performance improvements for journalists. securedrop.org/news/secured...
SecureDrop 2.15.1 is now available, improving memory management while handling APIv2 requests, and fixing an issue with restoring backups without transferring over the network:
SecureDrop 2.15.1 released
SecureDrop 2.15.1 is now available, improving memory management while handling APIv2 requests, and fixing an issue with restoring backups without transferring over the network:
securedrop.org
We're getting closer to the release of the brand new SecureDrop Inbox — today we're publishing results from the security audit we commissioned to ensure it's safe before putting it in the hands of journalists.
Security audit of new SecureDrop Inbox completed
In advance of the initial release of SecureDrop Inbox, we commissioned an independent security audit from X41 D-Sec.
securedrop.org
SecureDrop@securedrop.org · 4mo agoThis is the result of work begun by the SecureDrop team in July 2025 to completely overhaul how journalists process submissions. SecureDrop Workstation users will receive it automatically during a system update in the next few weeks.
SecureDrop 2.15.0 is now available, which enables the updated API needed for the upcoming SecureDrop Inbox.
SecureDrop 2.15.0 released
SecureDrop 2.15.0 is now available, which enables the updated API needed for the upcoming SecureDrop Inbox.
securedrop.org
SecureDrop Client 0.17.5 has been released to address a low-priority security issue. Exploiting this vulnerability would require a compromised server, and we are not aware of any exploits in the wild.
SecureDrop Client 0.17.5 released
SecureDrop Client 0.17.5 has been released to address a low-priority security issue. Exploiting this vulnerability would require a compromised server, and we are not aware of any exploits in the wild.
securedrop.org
SecureDrop Inbox, the new window into the SecureDrop Workstation, has been rewritten from the ground up to replace the previous client application for existing journalist users. Improving upon the core functionality, it also includes bug fixes, speed improvements, and a range of new features.
New features in SecureDrop Inbox
SecureDrop Inbox, the new window into the SecureDrop Workstation, has been rewritten from the ground up to replace the previous client application for existing journalist users. Improving upon the core functionality, it also includes bug fixes, speed improvements, and a range of new features.
securedrop.org
SecureDrop Workstation 1.5.2 has been released, as well as SecureDrop Client 0.17.4. This update contains multiple security fixes, all of which are low or informational priority. We are not aware of any exploitation in the wild for any vulnerability.
SecureDrop Workstation 1.5.2 released
This update contains multiple security fixes, all of which are low or informational priority. We are not aware of any exploitation in the wild for any vulnerability.
securedrop.org
The web’s security model has long relied on trusting the server. WEBCAT is an attempt to change that. Please help test it if you can. Your feedback at this early stage of development is extremely valuable. Excited to collaborate with @freedom.press & @securedrop.social.freedom.press.ap.brid.gy.
SecureDrop@securedrop.org · 5mo agoWeb applications are only as trustworthy as their servers, and servers can get hacked. That’s why we are introducing WEBCAT, which lets web browsers verify the origin of code before it runs. 🌞 Today, WEBCAT enters alpha testing! If you like to experiment with cutting-edge software, give it a try:
Web applications are only as trustworthy as their servers, and servers can get hacked. That’s why we are introducing WEBCAT, which lets web browsers verify the origin of code before it runs. 🌞 Today, WEBCAT enters alpha testing! If you like to experiment with cutting-edge software, give it a try:
Help us test WEBCAT alpha
Web applications are only as trustworthy as the servers that serve them, and servers can get hacked. So, last year, we introduced WEBCAT (Web-Based Code Assurance and Transparency), a project designed...
securedrop.org
SecureDrop is bringing our WEBCAT and SecureDrop Protocol projects to @rwc.iacr.org on March 9-11 in Taipei, Taiwan. We’ll be presenting on establishing trust in web applications and on the next generation of SecureDrop! Read more:
See you at Real World Crypto Symposium
We’ll be presenting on establishing trust in web applications and on the next generation of SecureDrop. Hope to see you in Taipei!
securedrop.org
SecureDrop 2.14.0 has been released. This release ensures KeePassXC remains installed on Tails. It also lays groundwork for the upcoming SecureDrop App.
SecureDrop 2.14.0 Released
This release ensures KeePassXC remains installed on Tails. It also lays groundwork for the upcoming SecureDrop App.
securedrop.org
SecureDrop Client 0.17.2 has been released! This release addresses potential undefined behavior in a dependency.
SecureDrop Client 0.17.2 released
This release addresses potential undefined behavior in a dependency
securedrop.org
What does it take to make web applications auditable? Here's why reproducibility matters, and how WEBCAT—a framework for signing and verifying web applications—approaches the problem in practice.
WEBCAT: Towards auditable web application runtimes
In this blog post, we examine the technical requirements for web applications to be properly auditable, arguing that reproducibility is a necessary condition. Enforcing the constraints needed to achie...
securedrop.org
Journalists are increasingly relying on insider sources, and protecting those sources is more important than ever. Here's how SecureDrop is rising to the challenge, safeguarding whistleblowers’ anonymity against ever-evolving threats.
Looking back at 2025
Journalists are working harder than ever to protect their sources. SecureDrop has never been more important
securedrop.org