New guidance advises sources against services linked to their personal identity; SecureDrop newsrooms should update landing pages with these new warnings

This release makes the sidebar width adjustable, lays the groundwork for right-to-left languages, and provides a number of correctness fixes.

Routine signing key phase-in underway; new key to begin signing SecureDrop software releases in 2027

This release hardens the updater against some edge cases discovered during the 1.8.0 release.

Security and privacy online are critical to protect users from eavesdroppers and attackers. The biggest success story of the last decade is HTTPS, the protocol that ensures the connection between a re...

This release adds support for double-encrypted messages and files, improves the source menu, and fixes an issue where multiple exports could be triggered at once

Browsers are beginning to be able to guarantee that the code running on a page is actually the code its developers published — no silent tampering, no trusting the server. We think the payoff is huge:

These releases add support for Debian 13 “trixie” and automatically upgrade the underlying VMs

SecureDrop 2.16.1, which fixes a low-severity security issue, is now available.

This release includes a number of improvements to APIv2, and a fix for a low-severity security vulnerability

All SecureDrop Workstation users should be using Qubes 4.3. If you have not upgraded, please contact support immediately

This release fully removes the legacy client package and fixes a number of accessibility-related issues.

SecureDrop Inbox 1.3.2 has been released to add extra warnings and safeguards when deleting large numbers of sources

These releases remove the legacy SecureDrop Client and enable an upgrade script to make preparing for the Qubes 4.3 upgrade simpler

SecureDrop Inbox 1.3.1 has been released to address a low-priority security issue in the securedrop-proxy component

The SecureDrop Client will not receive any further updates, and will be removed in a forthcoming Workstation release

Release enables Qubes 4.3 upgrade and prepares foundation for improved speed and security when processing submissions

This release adds a label to show the number of selected sources, disables downloading of files in offline mode, and updates a number of dependencies

Anonymous whistleblowing submission system for journalists and sources

This is a Qubes 4.3-only release, and takes advantage of some of its new features to provide a more robust and secure way for journalists to review submissions

This release increases the number of results returned by search, improves file handling and sync performance, and carries out other internal cleanup

This version fixes a number of small issues that didn’t make it into the previous release.

SecureDrop 2.15.1 is now available, improving memory management while handling APIv2 requests, and fixing an issue with restoring backups without transferring over the network:

In advance of the initial release of SecureDrop Inbox, we commissioned an independent security audit from X41 D-Sec.

SecureDrop 2.15.0 is now available, which enables the updated API needed for the upcoming SecureDrop Inbox.

SecureDrop Client 0.17.5 has been released to address a low-priority security issue. Exploiting this vulnerability would require a compromised server, and we are not aware of any exploits in the wild.

A new SecureDrop Inbox will be released in the next few weeks, the result of work begun by the team in July 2025 to redesign how journalists process submissions. SecureDrop Workstation users will receive it automatically during a system update.

SecureDrop Inbox, the new window into the SecureDrop Workstation, has been rewritten from the ground up to replace the previous client application for existing journalist users. Improving upon the core functionality, it also includes bug fixes, speed improvements, and a range of new features.

This update contains multiple security fixes, all of which are low or informational priority. We are not aware of any exploitation in the wild for any vulnerability.

Web applications are only as trustworthy as the servers that serve them, and servers can get hacked. So, last year, we introduced WEBCAT (Web-Based Code Assurance and Transparency), a project designed...

We’ll be presenting on establishing trust in web applications and on the next generation of SecureDrop. Hope to see you in Taipei!

This release ensures KeePassXC remains installed on Tails. It also lays groundwork for the upcoming SecureDrop App.

This release addresses potential undefined behavior in a dependency

In this blog post, we examine the technical requirements for web applications to be properly auditable, arguing that reproducibility is a necessary condition. Enforcing the constraints needed to achie...

Journalists are working harder than ever to protect their sources. SecureDrop has never been more important

YouTube video by The Tor Project

This minor fix allows configuration from Tails USB sticks for those running version 2.13.0 or greater of SecureDrop

This release provides the securedrop-admin tool as a Debian package within Tails, and prepares for future availability of the securedrop-admin utility on Qubes OS

This release addresses a low-impact, high-complexity denial-of-service issue

SecureDrop software engineer Cory Myers and ETH Zurich researcher Felix Linker gave a talk entitled ”SecureDrop — From Design to Analysis” to the Usable Formal Methods Research Group at the 124th meet...

This version simplifies installation via a bootstrap package from the Qubes-Contrib repo, and removes the existing dependencies on Whonix

This year we are calling to FREE THE INTERNET. Your donation will help break the chains of censorship and surveillance. If you give now during the campaign, your donation will be matched by our suppor...