> Side note, but GlobaLeaks requires JavaScript. This is an issue if you fear someone might try to exploit your browser.

JS is not the only surface attack. Also what's the point of targeting anyone who goes into *.onion if it risks burning up your high-price exploit?