SecureDrop

SecureDrop Inbox 1.7.1 is now available! This is a hotfix release that addresses an issue where exporting to USB devices would not work because the drives could not be unlocked.

We have updated our guidance for sources, to warn against using AI chatbots or services linked to their personal identity. We also strongly recommend that newsrooms using SecureDrop update their landing pages with these new warnings.

SecureDrop Inbox 1.7.0 is now available! This release makes the sidebar width adjustable, lays the groundwork for right-to-left languages, and provides a number of correctness fixes.

We will be rotating the SecureDrop release signing key next year. This is a routine signing key rotation as a best practice; the current key is still secure and in active use. The new key will be distributed in releases later this year and start signing releases in 2027.

SecureDrop Workstation 1.9.0 is now available! This release hardens the updater against some edge cases discovered during the 1.8.0 release.

Your phone won’t run an app that’s been tampered with, but your browser will run anything a server sends it. WEBCAT is a tamper-evident seal for web applications, developed by @freedom.press Find out more:

SecureDrop Inbox 1.6.0 is now available! This release adds support for double-encrypted messages and files, improves the source menu, and includes a small speedup to the sync process.

SecureDrop Workstation 1.8.0 and SecureDrop Inbox 1.5.0 are now available! These releases add support for Debian 13 “trixie” and automatically upgrade the underlying VMs.

SecureDrop 2.16.1, which fixes a low-severity security issue, is now available. If your instance was affected, administrators will need to take manual action to rotate credentials.

SecureDrop 2.16.0 is now available, with a number of improvements to APIv2, and a fix for a low-severity security vulnerability:

Qubes 4.2 is now end-of-life. All SecureDrop Workstation users should be using Qubes 4.3. If you have not upgraded, please contact support immediately.

SecureDrop Inbox 1.4.0 is now available! This release fixes a number of accessibility-related issues and fully removes the legacy client package:

SecureDrop Inbox 1.3.2 is now available! This update adds warnings and safeguards when deleting large numbers of sources.

SecureDrop Workstation 1.6.2, for Qubes 4.2, and 1.7.1, for Qubes 4.3, are now available! These releases remove the legacy SecureDrop Client and enable an upgrade script to make preparing for the Qubes 4.3 upgrade simpler.

SecureDrop Inbox 1.3.1 is now available! This release fixes a low-priority security issue in the securedrop-proxy component.

SecureDrop Client, which has been replaced by SecureDrop Inbox, is now end-of-life.

SecureDrop Workstation 1.6.1 is now available, allowing administrators to begin the process of upgrading to Qubes 4.3.

SecureDrop Inbox 1.3.0 is now available! This release adds a label to show the number of selected sources, disables downloading of files in offline mode, and updates a number of dependencies. securedrop.org/news/secured...

SecureDrop Workstation 1.7.0 has been released! This is a Qubes 4.3-only release, and takes advantage of some of its new features to provide a more robust and secure way for journalists to review submissions.

SecureDrop Inbox 1.2.0 is now available! This release increases the number of results returned by search, improves file handling and sync performance, and carries out other internal cleanup.

SecureDrop Inbox 1.1.0 is now available! This version fixes a number of small issues that didn’t make it into the previous release.

The inaugural release of SecureDrop Inbox is now available! 🎉 The Inbox is a full rewrite of our client, and includes many new features and performance improvements for journalists. securedrop.org/news/secured...

SecureDrop 2.15.1 is now available, improving memory management while handling APIv2 requests, and fixing an issue with restoring backups without transferring over the network:

We're getting closer to the release of the brand new SecureDrop Inbox — today we're publishing results from the security audit we commissioned to ensure it's safe before putting it in the hands of journalists.

SecureDrop 2.15.0 is now available, which enables the updated API needed for the upcoming SecureDrop Inbox.

SecureDrop Client 0.17.5 has been released to address a low-priority security issue. Exploiting this vulnerability would require a compromised server, and we are not aware of any exploits in the wild.

SecureDrop Workstation 1.5.2 has been released, as well as SecureDrop Client 0.17.4. This update contains multiple security fixes, all of which are low or informational priority. We are not aware of any exploitation in the wild for any vulnerability.

The web’s security model has long relied on trusting the server. WEBCAT is an attempt to change that. Please help test it if you can. Your feedback at this early stage of development is extremely valuable. Excited to collaborate with @freedom.press & @securedrop.social.freedom.press.ap.brid.gy.

Web applications are only as trustworthy as their servers, and servers can get hacked. That’s why we are introducing WEBCAT, which lets web browsers verify the origin of code before it runs. 🌞 Today, WEBCAT enters alpha testing! If you like to experiment with cutting-edge software, give it a try:

SecureDrop 2.14.0 has been released. This release ensures KeePassXC remains installed on Tails. It also lays groundwork for the upcoming SecureDrop App.

SecureDrop Client 0.17.2 has been released! This release addresses potential undefined behavior in a dependency.

What does it take to make web applications auditable? Here's why reproducibility matters, and how WEBCAT—a framework for signing and verifying web applications—approaches the problem in practice.

Journalists are increasingly relying on insider sources, and protecting those sources is more important than ever. Here's how SecureDrop is rising to the challenge, safeguarding whistleblowers’ anonymity against ever-evolving threats.

Catch our segment on @securedrop.org in @torproject.org's latest State of the Onion, alongside updates from other community projects:

SecureDrop Workstation 1.5.1 has been released! This minor fix addresses a Tails config location change found in version 2.13.0 of the SecureDrop server.

SecureDrop 2.13.0 is now available. This release primarily provides the securedrop-admin tool as a Debian package within Tails, and prepares for future availability of the securedrop-admin utility on Qubes OS.

SecureDrop Client 0.17.1 has been released! This release addresses a low-impact, high-complexity denial-of-service issue:

SecureDrop is building the next generation of anonymity tools for whistleblowers. SecureDrop software engineer Cory Myers and ETH Zurich researcher Felix Linker gave a talk in Montreal earlier this month about our new, custom messaging protocol:

SecureDrop Workstation 1.5.0 has been released! This version simplifies the installation process by allowing you to install a bootstrap package from the Qubes-Contrib repo, and removes the remaining dependencies on Whonix.

Tor is a critical component that helps make SecureDrop an effective tool for connecting journalists with anonymous sources. Learn more about @torproject.org's efforts to Free the Internet:

🚨 PSA: Do you have information to share with news outlets that have lost access to report from the Pentagon? You can share it while protecting your anonymity using @securedrop.org: