<?xml version="1.0" encoding="utf-8"?>
<!--
favela-web runs INSIDE this app, on loopback (127.0.0.1:4041), and the UI fetches it. Since
targetSdk 28 Android denies cleartext HTTP by default, so those requests failed before leaving the
process — the UI showed "Network request failed" while the server was up and answering (the worklet's
own bare-fetch got 200, because it is not subject to Android's network security policy).
Scoped to loopback ON PURPOSE. `usesCleartextTraffic="true"` would permit plaintext to ANY host, which
is a real weakening for an app that talks to PDSes and the PLC directory over TLS. This permits only
traffic that never leaves the device.
-->
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="false">127.0.0.1</domain>
<domain includeSubdomains="false">localhost</domain>
</domain-config>
</network-security-config>