wtclaude 26b8eecde6 fix(security): declare explicit network security config to forbid cleartext ...

The app is purely an HTTPS API client, but the manifest left
usesCleartextTraffic implicit, which SonarQube S5332 flags (cleartext is
implicitly permitted on older Android and a merged library manifest could
re-enable it). Add an explicit network security config:

- main/release: base-config cleartextTrafficPermitted="false" (no cleartext).
- debug override (app/src/debug/res/xml): re-permits cleartext to loopback
  (127.0.0.1/localhost) only, for local dev against http://127.0.0.1:3000.

This mirrors ServerUrl's rule (HTTPS required in release, HTTP allowed in
debug via allowInsecureHttp = BuildConfig.DEBUG) at the platform socket
layer. It also fixes a latent gap: at targetSdk 28+ the platform default
already blocks cleartext, so the debug loopback path only actually works
with the explicit domain-config now added.

Docs updated in RunicGateway/docs (android/PLAN.md M1).

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-20 23:39:12 -05:00

..

licenses

feat(ui): m5 shard-website design pass

2026-07-20 01:51:51 -05:00

src

fix(security): declare explicit network security config to forbid cleartext

2026-07-20 23:39:12 -05:00

build.gradle.kts

feat(sso): App Links autoVerify callback + paired-host trust check

2026-07-20 18:37:32 -05:00

proguard-rules.pro

feat(release): m6 release mechanics — signed APK, R8, version guard, icons

2026-07-20 03:35:06 -05:00