<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!--
        Cleartext (HTTP) traffic is intentionally permitted because LibreChat is a
        self-hosted server that users may run on their local network over plain HTTP
        (e.g. http://192.168.x.x:3080 or http://localhost:3080).

        Android's network_security_config is static and cannot be toggled at runtime,
        so we cannot restrict cleartext to specific domains since the server URL is
        user-configured. Instead, the app displays an HTTP warning dialog at server
        setup time (ServerUrlScreen) when the user enters an HTTP URL, informing them
        that their connection will not be encrypted. The user must explicitly
        acknowledge this risk before proceeding.

        HTTPS is always preferred and no warning is shown for HTTPS URLs.
    -->
    <base-config cleartextTrafficPermitted="true" />
</network-security-config>
