I'm not a fan of how they handled this situation.. they failed to verify that the encryption in their software was actually working and then tried to sprinkle sugar on it by calling it a "security vulnerability in the network protocol used by..". It wasn't a vulnerability in the protocol, they just didn't use it properly. If you make a mistake like that, you need to just own it.

https://radicle.dev/2026/09/23/disclosure-of-vulnerability-i...