From c1d99f943a09001a9758addc7724aefb11cf138b Mon Sep 17 00:00:00 2001 From: wtclaude Date: Mon, 20 Jul 2026 23:39:40 -0500 Subject: [PATCH] docs(android): note explicit network security config for cleartext posture Record that the app's HTTPS-only-in-release / HTTP-in-debug rule (ServerUrl, allowInsecureHttp = BuildConfig.DEBUG) is backed at the platform socket layer by an explicit network security config: main/release forbids all cleartext, a debug override re-permits cleartext to loopback only. Matches the fix in RunicGateway/Android-app (fix/manifest-cleartext-traffic). Co-Authored-By: Claude --- android/PLAN.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/android/PLAN.md b/android/PLAN.md index e344861..8535a85 100644 --- a/android/PLAN.md +++ b/android/PLAN.md @@ -491,7 +491,13 @@ compiled in. `/public/settings` for branding: name/colors/logo). Only on a successful, well-formed response is the URL persisted to DataStore and the app allowed to initialize its main UI. - Accept `https://host[/base]`; normalize/trim; require HTTPS in release builds (allow HTTP only in - debug for local dev against `127.0.0.1:3000`). + debug for local dev against `127.0.0.1:3000`). This app-layer rule (`ServerUrl`, + `allowInsecureHttp = BuildConfig.DEBUG`) is backed at the platform socket layer by an explicit + **network security config** (`res/xml/network_security_config.xml`, wired via + `application android:networkSecurityConfig`): the main/release config permits **no** cleartext, + and a debug-only override (`app/src/debug/res/xml/`) re-permits cleartext to loopback + (`127.0.0.1`/`localhost`) only. Being explicit also stops a merged library manifest from + re-enabling cleartext and clears the `usesCleartextTraffic`-implicitly-enabled scanner finding. - Failure states: unreachable, non-2xx, not-a-Runic-Gateway-site (missing expected `/public/status` shape), TLS error — each gets a clear retry message. Nothing else in the app runs until this succeeds.