SecureDrop is an open-source whistleblower submission system that media organizations use to securely accept documents from and communicate with anonymous sources.
The platform addresses the need for journalists to receive sensitive information from sources while protecting their anonymity and the confidentiality of submissions. SecureDrop provides a secure channel where sources can upload documents and journalists can review and respond to submissions without exposing the source's identity. The system is designed with security as a core principle, implementing encryption and anonymity protections throughout the submission and communication workflow.
SecureDrop is a stable, mature project actively deployed in newsrooms globally. It suits organizations that need to receive whistleblower submissions and require robust security guarantees. The project is managed by the Freedom of the Press Foundation. Most new feature development is directed toward related projects including SecureDrop Workstation, SecureDrop Client, and SecureDrop Protocol, while the core platform continues to receive security and bug fixes. Developers looking to contribute can set up a local instance using Docker on Linux, Windows, or macOS.
The project maintains clear separation between security issue reporting through a dedicated bug bounty program and standard issue tracking. Comprehensive documentation is available for end users and developers, with stable documentation recommended for production deployments and latest documentation for those tracking development. The codebase is written primarily in Python and uses Flask. The project welcomes contributions and maintains a code of conduct for participants.
