Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you have found a vulnerability, please DO NOT file a public issue. Please send us your report privately either via:

SecureDrop's public bug bounty program managed by Bugcrowd
Email to security@freedom.press (Optionally GPG-encrypted to 734F6E707434ECA6C007E1AE82BD6C9616DABB79

Path traversal in SecureDrop Client API.download_reply()
GHSA-6c3p-chq6-q3j2 published Feb 13, 2025 by lsd-cat

High
Path traversal in sd-log Qubes virtual machine
GHSA-933q-fx9h-5g46 published Feb 13, 2025 by lsd-cat

Moderate

Learn more about advisories related to freedomofpress/securedrop-client in the GitHub Advisory Database