Radicle Network Protocol Lacks Encryption, Causing Security Vulnerability
Problem
Multiple users highlight that Radicle's node‑to‑node traffic is unencrypted and unauthenticated, exposing sensitive data. The delayed security disclosure forces users to stop using private repositories, and the community criticizes the project as amateurish with serious security oversights.
Pain points
- Unencrypted node‑to‑node traffic
- Lack of authentication
- Delayed security disclosure forcing private repo shutdown
- Perceived amateurish implementation with serious security flaws
- User reluctance or refusal to adopt Radicle
Questions to verify
- Is the lack of encrypted network traffic an unacceptable risk for your use case?
- Would you consider switching to an alternative protocol like iroh?
- Do you need assurance of timely security patch delivery before adopting Radicle?
Evidence
quote · @匿名
What is the issue? Network traffic between nodes is not encrypted and not authenticated. Oh. After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic? Was this a case of thinking they'd handle it later, but then it fell off the TODO list?
quote · @匿名
This was reported to us by Konstantinos Maninakis on 2026-06-24. announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
quote · @匿名
The fact that this was reported three months ago and the "workaround" is to stop using private repos and assume they are all pwnd is quite something. How do you not notice that cross-node traffic is not encrypted when building something like this?
quote · @匿名
Radicle has been one of those projects that had seemed interesting, but something always bothered me about it... they never checked that payloads were encrypted. Ridiculous.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.