freedomofpress/securedrop

There are many ways to contribute to SecureDrop, and we welcome your help! By contributing to this project, you agree to abide by our Code of Conduct.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. It was originally created by the late Aaron Swartz and is currently managed by the Freedom of the Press Foundation.

Project status

SecureDrop is a stable, mature project that is actively in use in newsrooms across the globe. Most feature development efforts are focused towards the SecureDrop Workstation, SecureDrop Client, and SecureDrop Protocol; see the "Future directions for SecureDrop" blog post for more information.

SecureDrop continues to receive security and bug fixes in the meantime.

Documentation

SecureDrop's end user documentation is hosted at https://docs.securedrop.org. It is maintained in a standalone repository: https://github.com/freedomofpress/securedrop-docs.

By default, the documentation describes the most recent SecureDrop release. This is known as the stable version and is recommended for end users (Sources, Journalists, or Administrators). The latest documentation is automatically built from the most recent commit to the SecureDrop documentation repository. It is most useful for developers and contributors to the project. You can switch between versions of the documentation by using the toolbar in the bottom left corner of the Read the Docs screen.

Developer documentation can be found at https://developers.securedrop.org/, maintained in https://github.com/freedomofpress/securedrop-dev-docs/.

Found an issue?

If you're here because you want to report an issue in SecureDrop, please observe the following protocol to do so responsibly:

• If you want to report a security issue, please use our bug bounty hosted by Bugcrowd.
• If filing the issue does not impact security, just create a GitHub Issue.

How to Install SecureDrop

See the Installation Guide.

How to Use SecureDrop

• As a source
• As a journalist

How to Contribute to SecureDrop

See our contribution page.

Developer Quickstart

To run SecureDrop locally, ensure you have Docker installed before proceeding any further.

Linux (CentOS/Debian/Fedora/RHEL/Ubuntu)

• Follow the official Docker Engine documentation to install Docker Engine.

[!TIP] It's also possible to use Docker Desktop on Linux, if you want to. Follow the steps to install Docker Desktop for Linux then.

Windows/MacOS

• If you are using Windows or MacOS follow the official Docker Desktop documentation to install Docker Desktop.

Once you have Docker up and running, run:

make dev

This will start the source interface on 127.0.0.1:8080 and the journalist interface on 127.0.0.1:8081. The credentials to login are printed in the Terminal. To login to the journalist interface, you must also generate a two-factor code.

To provision a Python 3 virtual environment for development:

make venv && source ./venv/bin/activate

License

SecureDrop is open source and released under the GNU Affero General Public License v3.

Wordlists

The wordlist we use to generate source passphrases come from various sources:

• en.txt is based off a new Diceware wordlist from the EFF.
• fr.txt is based off Matthieu Weber's translated diceware list and the French word list found in trezor/python-mnemonic (MIT licensed).

Acknowledgments

A huge thank you to all SecureDrop contributors! You can find a list of code and documentation contributors in the "Contributors" tab on GitHub. SecureDrop is translated into many languages by a community of volunteers; please see our Weblate instance for details. Thanks to our friends at PyUp for sponsoring a subscription to their Python security database.