<?xml version="1.0" encoding="utf-8"?>
<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
<!--
  Debug-only override of the main network_security_config.xml. Keeps the secure
  base posture (no cleartext) but re-permits cleartext to loopback so debug builds
  can reach a local website backend at http://127.0.0.1:3000 / http://localhost:3000
  (ServerUrl allows plain HTTP only when allowInsecureHttp = BuildConfig.DEBUG).
  Because the platform default already blocks cleartext at targetSdk 28+, this
  domain-config is what actually makes the debug local-dev path work at runtime.

  This file is compiled only into debug builds; release builds use the main
  source set's config and permit no cleartext at all.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">127.0.0.1</domain>
        <domain includeSubdomains="false">localhost</domain>
    </domain-config>
</network-security-config>
