Hush Line

Hush Line is an open source whistleblower platform for secure, anonymous disclosures to journalists, lawyers, and other trusted recipients, with optional end-to-end encrypted account conversations for follow-up.

Hosted service: Start here:

Why Hush Line

Hush Line is built for safety-critical reporting workflows where trust, anonymity, and usability all matter. The project design priorities are:

Usability of the software
Authenticity of the receiver
Plausible deniability of the whistleblower
Availability of the system
Anonymity of the whistleblower
Confidentiality and integrity of disclosures

Core Capabilities

| Area | What Hush Line Provides | | ---------------------- | -------------------------------------------------------------------------------------------------------------- | | Anonymous submissions | No submitter account required for sending disclosures | | Encryption | End-to-end encrypted submissions with recipient PGP keys, plus server-side fallback path | | Receiver trust | Verified account workflow and trusted directory UX | | Account security | Password authentication with optional TOTP / WebAuthn key MFA | | Privacy access | Tor onion support and privacy-preserving defaults | | Communication workflow | Message status management, reply links, signed E2EE account conversations, and optional email forwarding modes | | Org customization | Branding controls, onboarding guidance, and configurable profile fields | | Operational controls | Strong CI checks, migration compatibility testing, and workflow security validation |

Quickstart (Local)

1) Clone and start

git clone https://github.com/scidsg/hushline.git
cd hushline
make serve

Open .

If you only want to start the current stack without first tearing it down, you can still use docker compose up or make run.

If you want a slower, guided setup for a brand-new machine, use the AI-ready prompt in docs/LOCAL-CONTRIBUTOR-ONBOARDING-PROMPT.md. It walks a new contributor through installing Git, Make, Docker, cloning the repo, starting the stack, and trying the first three local flows.

2) Common commands

| Command | Purpose | When to use | | ----------------------------------------- | ---------------------------------------- | ------------------------------------------------- | | make serve | Tear down and rebuild the local stack | Starting fresh or recovering from Docker drift | | make lint | Run formatting/lint/type checks | Before opening a PR or after code changes | | make test | Run full test suite with coverage output | Before opening a PR and after behavior changes | | make fix | Apply formatting/lint autofixes | When lint reports fixable formatting/style issues | | make run | Start the current local stack | Quick restarts when you do not need a full reset | | make run-full | Run Stripe-enabled development stack | Testing paid-tier or Stripe-related flows | | docker compose down -v --remove-orphans | Reset local Docker state | Clearing containers, volumes, and orphaned state |

Security and Privacy

Threat model: docs/THREAT-MODEL.md
Two-way chat E2EE implementation reference: docs/TWO-WAY-CHAT-E2EE.md
Two-way chat E2EE technical whitepaper: docs/HUSH-LINE-TWO-WAY-CHAT-E2EE-WHITEPAPER.md
Security policy and vulnerability reporting: SECURITY.md
Privacy policy: docs/PRIVACY.md

Report security issues through GitHub Security Advisories when possible, or via: .

Agentic Coding Policy

Hush Line uses a risk-based model for agentic software development. Canonical policy: scidsg/hushline-agents.

Quick summary:

Human-first is required for high-risk surfaces: funding work, databases/migrations, auth, payments, CI/CD, production infrastructure, and security/privacy boundary changes.
AI-first is allowed for low-risk work such as scoped docs/process edits and isolated low-risk implementation tasks with clear rollback.
If scope expands into high-risk areas (for example DB/auth/env/security), ownership immediately escalates to human-first.
Ownership mode is tracked (human-first vs ai-first) with a quarterly operating target of roughly 70/30.
Approved coding model policy is defined in AGENTS.md. As of 2026-05-11, the minimum approved coding model is gpt-5.5 high.

Contributor Checklist

Before opening a PR:

Read and follow AGENTS.md (repository policy and safety-critical rules).
Check open Dependabot updates first, then handle applicable dependency/security updates.
Keep diffs minimal and behavior-preserving unless a behavior change is explicitly intended.
Add or update tests for every behavior change.
Run required checks locally:

- make lint - make test

If behavior-critical paths changed, run CI-style coverage validation:

docker compose run --rm app poetry run pytest --cov hushline --cov-report term-missing -q --skip-local-only

Run dependency vulnerability audits:

make audit-python
make audit-node-runtime

When frontend/runtime dependencies change, also run:

make audit-node-full

If local audit commands are blocked by network/tooling availability, document that in the PR and wait for a passing Dependency Security Audit workflow before merge.

Ensure commits are cryptographically signed and verifiable on GitHub.

Documentation Map

Docs index: docs/README.md
Local contributor onboarding prompt: docs/LOCAL-CONTRIBUTOR-ONBOARDING-PROMPT.md
Developer notes: docs/DEV.md
Architecture: docs/ARCHITECTURE.md
Two-way chat E2EE: docs/TWO-WAY-CHAT-E2EE.md
Two-way chat E2EE whitepaper: docs/HUSH-LINE-TWO-WAY-CHAT-E2EE-WHITEPAPER.md
Runner automation: Agent automation and policy
Terms: docs/TERMS.md

Latest Screenshots

More screenshots:

Quotes

Psst

“Psst.org uses Hush Line as our platform for the Psst Safe, where tech and AI worker can make collective disclosures and get pro bono support. Its straightforward architecture made it adaptable to our needs and a core part of our whistleblower infrastructure, supporting intake, identity protection and the secure storage of disclosures so insiders can collectivize.”

Center for Investigative Reporting

"The simplicity and security of Hush Line are an incredible match for the world of investigative journalism. Our team can manage our tip line themselves, something I simply cannot say about other options."

In the Media

Privacy Guides

“After using their platform for the past few weeks, I can comfortably write that Hush Line accomplishes its mission astoundingly well. Not only is customer support excellent for enterprise users, but its integration with PGP encrypted email makes it a lifesaver for a Thunderbird user like me. The ability to receive encrypted notifications via email is honestly an underrated feature.”

— Privacy Guides (archive)

Newsweek

“Investing in technology that protects privacy—such as Hush Line and Signal—is also important in sharing information that is anonymous, and can't be subpoenaed.”

— Newsweek (archive)

TIME

“Psst’s safe is based on Hush Line... a simpler way for sources to reach out to journalists and lawyers... Micah Lee, an engineer on Hush Line, says that the tool fills a gap in the market for an encrypted yet accessible central clearinghouse for sensitive information.”

— TIME (archive)

Substack

“New systems in development, such as Hush Line, are the brave new frontier in reporting. Hush Line is a software application that offers a more secure ability to report anonymously.”

— Substack

Podcasts

“I'm working with a non-profit software company called Hush Line, which is a one-way encrypted anonymizing platform so that whistleblowers can reach out to individual journalists while remaining anonymous...”

— YouTube

Contributing and Conduct

Contributors are expected to follow the Code of Conduct:

License

See LICENSE.

scidsg/hushline: Anonymous, end-to-end encrypted tip lines and chat for organizations and individuals.