I think SecureDrop is the gold standard in this area - does GlobaLeaks offer anything over SecureDrop?
JS is not the only surface attack. Also what's the point of targeting anyone who goes into *.onion if it risks burning up your high-price exploit?
Maybe the two softwares serve different use cases?
https://blog.torproject.org/italian-anti-corruption-authorit...
But a few years ago, GlobaLeaks was a lot simpler to install and administer than SecureDrop. Which ment smaller organisations could afford to have an instance.