<?xml version="1.0" encoding="utf-8"?>
<!--
  Android 9 (API 28) and later block cleartext HTTP by default, which would
  stop the app reaching the development API over http://.

  This config is referenced ONLY from the debug manifest, and only whitelists
  the loopback addresses used in development:
    10.0.2.2   - the host machine as seen from the Android emulator
    10.0.3.2   - the same, from Genymotion
    localhost  - a physical device port-forwarded with `adb reverse`

  Release builds keep Android's default: HTTPS only.
-->
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">10.0.3.2</domain>
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
