The SecureDrop team is currently working on an integrated SecureDrop Workstation that combines the previously separate Journalist Workstation and Secure Viewing Station into a single device, based on Qubes OS. This represents a potential major change to the SecureDrop architecture and threat model, which is why we have sought independent review of the technical choices we are making.

We are pleased to announce that Include Security, with direct funding from the Open Technology Fund, has completed an independent audit of the first alpha (developer-focused) release of the SecureDrop Workstation.

As the report notes, this audit was intentionally limited in scope:

IncludeSec found no medium-risk, high-risk, or critical-risk issues as part of their review. The auditors shared 5 low-risk findings and 2 informational findings in their report. Please see the full audit report (PDF) for details.

The SecureDrop team has met with IncludeSec to discuss these findings. As a result of that discussion, we have filed the following new issues:

• Investigate disabling /rw customizability for sd-svs, other AppVMs

• Create AppArmor profile for Securedrop client

• Investigate mitigation against reply exfiltration of data

• Display system alert recommending shutdown after 5 days of inactivity

• Investigate use of sudo password to provide guardrails for journalist users

• Force hard system shutdown instead of suspend/hibernate

• Support hardware token for GPG decryption

• Support API token blacklisting and add API /logout endpoint

We would like to thank the IncludeSec team for its careful review, and OTF for funding this important work.