mirror of
https://seed.radicle.dev/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5.git
synced 2026-10-25 22:30:34 +08:00
Yorgos Saslis
3129de3b95
All released versions of Radicle are affected by vulnerabilities [1] in the network protocol: traffic is unencrypted and peers are not authenticated. A network observer can read the contents of private repositories, and an attacker can impersonate a node that to fetch them. No fix has been released yet. Since users may rely on private repositories being confidential, `rad init` now warns about this before the interactive "Visibility" prompt, so the warning is printed before the choice is made. The warning is printed again in the epilogue whenever the created repository is private. This also covers `--private`, which skips the prompt. Update the `rad-init-private` and `rad-init-private-no-seed` examples to match the new output. [1]: https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol