heartwood

Every Radicle node through 1.10.3 sends private repository data unencrypted after the handshake

Radicle's node software never uses the session keys its Noise handshake creates, so private Git data crosses the network in cleartext. No release through 1.10.3 is patched, and teams should treat anything already fetched over clearnet as public.