Radicle tells users to stop using private repositories over its network

Why it matters

Radicle's security warning shows how a peer-to-peer code forge can preserve repository integrity while still exposing private data at the transport layer. Its fix requires a major protocol upgrade that will divide nodes that upgrade from those that do not.

Radicle told users on September 23rd to stop using private repositories over its peer-to-peer network after disclosing two vulnerabilities affecting every released version. The notice puts the project founded by Eleftherios Diakomichalis and Alexis Sellier in a difficult position: the network was built to let developers collaborate without a central host, yet its current transport can expose private code to people watching connections between nodes.

Radicle's security disclosure says node-to-node traffic is sent without encryption, allowing someone who can observe the network path to read data in transit. A separate flaw lets a connecting peer claim a Node ID that is not its own. Since private repositories are shared with allow-listed IDs, an attacker who knows an allowed ID can impersonate that peer and request a repository directly.

The combination sharpens the risk. A network observer can see the IDs on both ends of a connection and use one to request the repository later. Radicle says the allow-list is not public, making impersonation harder for someone without that vantage point. But its warning is direct: no repository setting or allow-list protects against an attacker already positioned on the network path.

The sovereignty trade-off

Diakomichalis and Sellier founded Berlin-based Monadic GmbH in January 2018 to pursue what Radicle's project history calls a "sovereign developer stack." Diakomichalis came to the project after leading data science and engineering at SoundCloud, according to his Devcon biography. Radicle's premise was that developers should control their repositories and collaboration tools rather than depend on a centrally operated service.

That design shifts responsibility as well as control. In Radicle, repositories are replicated among peers rather than stored behind one company's hosting service. A private repository's access list controls which peers can fetch it, but it does not encrypt the data moving between authorized peers. When the transport layer fails to provide that protection, the absence of a central server does not remove the exposure; it changes where the user must look for it.

Radicle says repository contents remain authenticated through Git objects and Signed References. The flaws do not let an attacker forge code or identities, according to the disclosure. The immediate issue is confidentiality: an observer can read the exchanged objects, while the impersonation bug can help turn observed peer information into access to a full repository.

What users should do

Radicle recommends stopping network use of private repositories until an update is available and treating any private repository previously transmitted to another node as leaked. If a repository contained unencrypted credentials, keys or tokens, Radicle advises rotating them. Users can block a repository from seeding with rad block <RID>; Radicle cautions that this is more reliable than rad unseed for nodes whose default seeding policy was changed to allow. Stopping a node does not erase local copies or retrieve copies already fetched by other peers.

The notice also warns that VPNs, Tor and I2P are not a complete fix. Such transports may limit what an observer on one network path can see, but do not repair peer authentication. Konstantinos Maninakis, who reported the cleartext issue on June 24th, separately describes using a tunnel between machines a team controls as a way to protect that particular hop. That is narrower advice than a general security fix: Radicle's warning is that an overlay alone does not address impersonation.

Maninakis says he found the cleartext behavior while building Grove, a browser-based Radicle node. His technical account describes implementing the protocol in TypeScript and inspecting traffic after his correctly encrypted implementation could not communicate with live Radicle nodes. Radicle credits Maninakis and a second reporter identified as "cryptocode"; Radicle says it received the peer-impersonation report on August 12th.

A breaking fix, and a divided network

Radicle plans to replace its custom Noise-based networking protocol with iroh, an open-source peer-to-peer networking stack. The project says the change is incompatible on the wire and cannot be made backward-compatible because the protocol lacks version negotiation. The fix therefore requires a major release: upgraded nodes will not communicate with nodes that remain on the existing network.

Radicle says it is trying to keep storage compatible while concentrating the break at the network layer. Iroh would also bring NAT traversal, which Radicle says could improve network reliability. Neither benefit removes the immediate cost: maintainers and users will have to coordinate an upgrade across a system designed to avoid dependence on a central operator.

That migration is the operational test behind the disclosure. Radicle's FAQ counted nearly 8,000 repositories on its public seed nodes and more than 600 nodes online weekly as of April 2026. Those are network activity measures, not counts of users or private repositories exposed. The project has not quantified how many private repositories may have crossed the network in vulnerable form.

Radicle has previously attracted outside backing: The Block reported that NFX and Galaxy Digital co-led a $12 million financing in 2021, with Placeholder and several individual investors participating. That round backed the project's effort to build an alternative code-collaboration network; the security disclosure now describes the less visible cost of operating one. The urgent work is restoring a basic expectation of private code collaboration before the next major version asks the network to split in two.