<?xml version="1.0" encoding="utf-8"?>
<!--
  Transport security policy. Cleartext is never permitted, and only the system CA
  store is trusted — user-installed CAs are not, which closes the "malicious profile"
  MITM vector. To reach a box with a private/self-signed cert, install its CA in the
  device system store or pin it via ServerTrustPolicy.PinPublicKeySha256.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>
