Radicle discloses that its node protocol is neither encrypted nor authenticated

Sources: primary, discussion
Summary: Radicle disclosed on 2026-09-23 that its node protocol provides neither encryption nor authentication. Every released version is affected and no fix exists yet. The project tells users to stop seeding private repositories, treat anything already synced as disclosed, and rotate credentials those repositories contained.
Why it matters: Every released version is affected, no fix exists yet, and the project tells users to stop seeding private repositories, treat anything already synced as disclosed, and rotate credentials it contained.
Follow-up: Track the protocol fix and the version that carries it, and whether Radicle publishes guidance on detecting what was already pulled from seeded nodes.