From 1333db5d1dfef6eb3628162d5617bba293f79151 Mon Sep 17 00:00:00 2001
From: Andrew Ridgway <ar17787@gmail.com>
Date: Tue, 4 Aug 2026 23:14:12 +1000
Subject: [PATCH] security: enforce HTTPS via network security config

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---
 app/src/main/AndroidManifest.xml                 | 1 +
 app/src/main/res/xml/network_security_config.xml | 8 ++++++++
 2 files changed, 9 insertions(+)
 create mode 100644 app/src/main/res/xml/network_security_config.xml

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index caf2a3e..9d1ea27 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -11,6 +11,7 @@
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.ResBuilder"
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..8bb2cc2
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Enforce HTTPS for the backend API domain. Cleartext is disallowed. -->
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="false">resume.aridgwayweb.com</domain>
+    </domain-config>
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>