<?xml version="1.0" encoding="utf-8"?>
<!--
    LedGrab is a LAN-only app:
      - Inbound: web UI / API on the device (HTTP, port 8080)
      - Outbound: WLED HTTP/UDP, Home Assistant, MQTT brokers, mDNS

    All of these are plaintext on the local network. Android's network
    security config doesn't support CIDR allowlists, so we cannot
    restrict cleartext to RFC1918 ranges declaratively — we have to
    permit cleartext base-wide.

    Defence-in-depth that ACTUALLY mitigates this:
      1. Inbound: the FastAPI server in this app rejects non-loopback
         requests when no API key is configured (see ledgrab.api.auth).
         The Android launcher auto-generates an API key on first run
         (see ApiKeyManager.kt) and injects it via the
         LEDGRAB_AUTH__API_KEYS env var before uvicorn starts. The
         user's phone receives the key by scanning the QR, which
         embeds the key as a URL fragment (never logged server-side).
      2. Outbound: targets are validated by net_classify in the Python
         layer (LAN-only HTTP, SSRF-safe).

    DO NOT remove the cleartext permission without first migrating
    every LAN peer to HTTPS — most WLED firmware, mDNS, and the LAN
    HTTP server itself rely on this flag.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="true" />
</network-security-config>
