Request disclosure via cross-origin redirect following

Information disclosure in securedrop-proxy in SecureDrop Client before 1.3.1 allows context-dependent attackers to read request metadata via cross-origin redirects. In proxy/src/main.rs, the reqwest client kept its default redirect behavior, so 30x Location headers from the configured server were followed instead of being returned unchanged, letting that server steer proxy traffic off the pinned origin. Exploitation requires a malicious or previously compromised SecureDrop Server for the same workstation; GitHub rates the impact as low confidentiality because proxied requests do not contain plaintext source or journalist communications.