<?xml version="1.0" encoding="utf-8"?>
<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
<!--
  The app is purely an HTTPS API client of a shard's website backend, so the base
  posture forbids all cleartext (HTTP) traffic. This makes explicit what minSdk 29 /
  targetSdk 35 already default to, satisfies the "usesCleartextTraffic implicitly
  enabled" scanner finding, and stops any merged library manifest from re-enabling
  cleartext. It also mirrors ServerUrl's release-build rule (HTTPS required) at the
  platform socket layer — defense in depth.

  The debug variant overrides this file (app/src/debug/res/xml/) to re-permit
  cleartext to loopback only, for local dev against http://127.0.0.1:3000.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>
