Security

SECURITY.md

Reporting security issues

Reporting a Vulnerability

If you have found a vulnerability, please DO NOT file a public issue. Please send us your report privately either via:

SecureDrop's public bug bounty program managed by Bugcrowd
Email to security@freedom.press (Optionally GPG-encrypted to 734F6E707434ECA6C007E1AE82BD6C9616DABB79)

Onion Service client auth credentials copied to Monitor Server
GHSA-rqwh-4873-322p published Jul 8, 2026 by legoktm

Low
API session token can be reused against web UI
GHSA-78xq-8jf3-gpfx published Jun 24, 2026 by legoktm

Moderate

Learn more about advisories related to freedomofpress/securedrop in the GitHub Advisory Database