<?xml version="1.0" encoding="utf-8"?>
<!--
  Cleartext HTTP stays blocked everywhere except loopback.

  Downloaded media is served to the webview by a local HTTP server on
  127.0.0.1 (see media_server.rs / DR-137). Release builds set
  usesCleartextTraffic="false", so Android's network security policy rejected
  those requests before any I/O happened and offline video failed instantly with
  NETWORK_NO_SOURCE.

  Only 127.0.0.1 is exempted. The base config keeps the release default, so a
  remote server still has to be HTTPS — this must not become a blanket
  cleartext opt-in.

  TRACES: UR-071 | DR-138
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />

    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
