OpenWhistle Files

OpenWhistle v0.1.0

First stable release of OpenWhistle — an open source whistleblower reporting platform compliant with the German Hinweisgeberschutzgesetz (HinSchG) and EU Directive 2019/1937.

Warning: This is an early release. Review carefully before deploying in a production environment with real whistleblowers.

Highlights

• Full anonymity — No IP addresses logged at any layer (nginx + application)
• Two-factor whistleblower access — Case number (OW-YYYY-NNNNN) + UUID4 secret PIN
• Bidirectional communication — Required by HinSchG §17; whistleblower can reply to investigators
• HinSchG SLA tracking — 7-day acknowledgement (§17 Abs. 1) and 3-month feedback (§17 Abs. 2) deadlines with visual indicators
• Mandatory TOTP MFA — All admin accounts require an authenticator app
• OIDC SSO — Optional single sign-on via any OpenID Connect provider
• CSRF protection — Double-Submit Cookie pattern on all state-changing forms
• DSGVO compliant — All fonts and assets self-hosted; hard deletion support (Art. 17)
• Setup wizard — First-run admin account creation via web UI
• Demo mode — DEMO_MODE=true seeds sample data for evaluation

Docker

:::bash
docker pull ghcr.io/openwhistle/openwhistle:0.1.0

Available on:

• ghcr.io/openwhistle/openwhistle:0.1.0
• docker.io/openwhistle/openwhistle:0.1.0
• quay.io/openwhistle/openwhistle:0.1.0

Quick Start

:::bash
git clone https://github.com/openwhistle/OpenWhistle.git
cd OpenWhistle
cp .env.example .env  # edit SECRET_KEY and database credentials
docker compose up -d

Then open http://localhost:4009/setup to create the first admin account.

Requirements

Full Changelog

See CHANGELOG.md (github.com) for the complete list of changes.