Today we are announcing the release of SecureDrop 0.3.8, to fix a regression in 0.3.7 where a dependency of SecureDrop's Python web application was mistakenly removed from the list of dependencies.  Read More

Today we are announcing the release of SecureDrop 0.3.7. Read More

Today we are announcing the release of SecureDrop 0.3.6. If you are a SecureDrop administrator, please check your instance to ensure that you are running the latest version; if not, follow the instructions below to upgrade your system. Read More

Today the Tow Center for Digital Journalism at Columbia Journalism School has published a first-of-its-kind study on how newsrooms are using SecureDrop, our open-source whistleblower submission system that is now in-use at over thirty news organizations worldwide. Read More

In July, we announced the release of SecureDrop 0.3.4 and published the accompanying security audit by iSEC partners (now NCC Group). The audit found 10 issues, one of which – issue 7, Finding ID iSEC-15FTC-4 – was redacted. It was redacted because it was not an issue in SecureDrop itself, but in one of its dependencies. At the time, NCC Group and Freedom of the Press Foundation agreed that NCC Group should responsibly disclose the issue to the affected project's team, and that we would wait until the project team had had time to develop a fix before publicizing the issue. Read More

Today we’re announcing SecureDrop 0.3.4, the latest release of SecureDrop, and publishing the results of the accompanying security audit by iSEC Partners. This is our fourth audit of SecureDrop.  Read More

Today, we’re announcing the latest major release of SecureDrop, our open-source whistleblower submission system. SecureDrop 0.3 uses the same basic architecture found in 0.2, but contains numerous improvements focused on better usability for both journalists and sources, a radically simplified installation process, and an auto-updating procedure that allows us to deliver important fixes to all SecureDrop installations in a timely manner. Read More

On Wednesday morning, the Tor Project published a security advisory detailing an attack against the Tor network that appears to have been trying to deanonymize users. SecureDrop, our open-source whistleblower submission system, is heavily reliant on Tor and uses the anonymity network to facilitate communication between whistleblowers, journalists, and news organizations. For this reason, we wanted to clarify how the attack affects users of SecureDrop. Read More