Radicle's network protocol leaks private repos in plain text, and a broken handshake lets attackers impersonate trusted nodes

Radicle: Disclosure of Vulnerability in the Network Protocol

Radicle disclosed two critical flaws in its node network protocol: traffic is unencrypted and unauthenticated, so anyone on the network path can read data in transit, and a broken handshake allows Node ID impersonation to fetch private repos. All released versions are affected. Users should stop seeding private repositories over the network and treat any transmitted private repo as leaked. A fix will be a breaking major release replacing the custom Noise-based protocol with iroh.