Investigate automation of regular SecureDrop directory audits

FPF maintains a SecureDrop directory at https://securedrop.org/directory

SecureDrops are listed if they meet certain requirements, most of which apply to their accompanying landing/tips page, as outline in the documentation. Many of these requirements are strict, and some are just preferred.

In brief, the externally auditable requirements for a SecureDrop landing page are:

• Use HTTPS
• Not be on dedicated subdomain
• Load in Tor browser
• Not include hyperlinks to the SecureDrop instance's .onion address
• Not include hyperlinks to the SecureDrop.org
• Load no third part assets or trackers
• Have the desired settings for a large selection of HTTP response headers

We do regular audits of all the SecureDrops in the directory to confirm they are still meeting these requirements. Currently this process is done manually. The directory website itself does some automated scans, and includes a warning on a directory listing if certain requirements are not met. See https://github.com/freedomofpress/securedrop.org/blob/develop/scanner/scanner.py

The securedrop.org website scans work, but are limited. In practice they often produce false-positives e.g. due to a landing page being protected by Cloudflare. They also do not perform a full audit of all the requirements.

The proposal is to investigate developing a full automated regular directory audit. In relation to the current scanner built into the website, this could be independent, supplementary, or a replacement.

Some advantages:

• Immediately surface changes in a landing page that violate a requirement, allowing for quicker and more effect remediation
• Reduce human-time spent doing manual directory audit

Start by reading scanner/scanner.py and the landing-page requirements in the linked SecureDrop documentation. Compare the existing scans with each listed audit requirement, including the known Cloudflare false positives, and determine whether an independent, supplementary, or replacement audit is appropriate. Done means producing a concrete investigation and scope for regular automated directory audits.