Radicle warns private repositories are exposed by two network flaws

Radicle disclosed two critical flaws affecting every version of its peer-to-peer code collaboration software and advised users to stop sharing private repositories over its network until a fix is released. Traffic between nodes travels without encryption, allowing someone on its network path to read exchanged data. A separate handshake flaw can let an attacker impersonate an authorized node and fetch a private repository. Radicle says the flaws can work together when an observer learns authorized node IDs from traffic. It advises users to treat previously transmitted private repositories as leaked and rotate any exposed credentials. The planned network-protocol replacement will break compatibility between upgraded and older nodes; signed references still protect repository contents against forgery.