From 3b8af4faeca81cb598ad3d366d64d8148534d150 Mon Sep 17 00:00:00 2001
From: Peter Stone <thepeterstone@gmail.com>
Date: Sat, 22 Aug 2026 01:08:35 +0000
Subject: Cleartext exception for 2 feeds with no working HTTPS

webpolicy.org and bit-player.org are genuinely alive but have no
working HTTPS at all (confirmed live, not a config mistake -- see
AppDatabase's v7/v8 migration comments for the investigation).
Everything else stays cleartext-blocked, same as the platform default
with no config at all. Isolated to just this file plus the one
networkSecurityConfig line, so both domains (or this whole exception)
can be removed cleanly if these feeds are ever dropped.
---
 app/src/main/res/xml/network_security_config.xml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 app/src/main/res/xml/network_security_config.xml

(limited to 'app/src/main/res/xml')

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..c569ba1
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Two feeds (webpolicy.org, bit-player.org) are genuinely alive but have no working
+  HTTPS at all (confirmed live, not a config mistake, see AppDatabase's v7/v8 migration
+  comments for the investigation). Everything else stays cleartext-blocked, same as the
+  platform default with no config at all. Deliberately isolated to just this file plus
+  the one networkSecurityConfig line in AndroidManifest.xml, so both domains, or this
+  whole exception, can be removed cleanly if these feeds are ever dropped instead.
+-->
+<network-security-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">webpolicy.org</domain>
+        <domain includeSubdomains="false">bit-player.org</domain>
+    </domain-config>
+</network-security-config>
-- 
cgit v1.2.3