Block cleartext HTTP

[alexfin90]

@claude in Android you can block HTTP cleartext and only allow HTTPS traffic using usesCleartextTraffic="false" or, better, a network-security-config with cleartextTrafficPermitted="false"
Implement and open a PR

[alexfin90]

@claude do it

[claude]

Claude finished @alexfin90's task in 48s —— View job • claude/issue-4-20260327-2311 • Create PR ➔

---

Implementing Cleartext HTTP Block

• Explore project structure
• Create network_security_config.xml
• Update AndroidManifest.xml
• Commit and push

Changes Made

app/src/main/res/xml/network_security_config.xml (new file):

<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>

app/src/main/AndroidManifest.xml: added android:networkSecurityConfig="@xml/network_security_config" to the <application> tag.

This blocks all cleartext (HTTP) traffic for the app — any non-HTTPS request will be rejected by the OS.

[alexfin90]

@claude I think is better also add the android:usesCleartextTraffic="false" in the manifest what do you think?

[claude]

Claude finished @alexfin90's task in 1m 21s —— View job • claude/issue-4-20260327-2320 • Create PR ➔

---

Implementing Cleartext HTTP Block (Enhanced)

• Gather context
• Implement changes
• Commit and push

Opinion on android:usesCleartextTraffic="false"

Yes, adding both is the right approach. Here's the reasoning:

Attribute	Scope	API level
android:usesCleartextTraffic="false"	Framework-level; checked by HttpURLConnection, some libraries directly	API 23+
network-security-config with cleartextTrafficPermitted="false"	More granular; can be scoped per domain, also covers SSLSocket	API 24+

They're fully compatible and complementary. With minSdk=29, both always apply — having both makes the security intent explicit and provides defense-in-depth.

Changes Made

app/src/main/res/xml/network_security_config.xml (new file):

<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>

app/src/main/AndroidManifest.xml: added both attributes to <application>:

android:networkSecurityConfig="@xml/network_security_config"
android:usesCleartextTraffic="false"

• claude/issue-4-20260327-2320