usesCleartextTraffic=true: Scope the Exception, Do Not Disable Security Globally

Identify the failing request first

A “cleartext traffic not permitted” error is about the network security policy, not necessarily the Android INTERNET permission. Capture the exact URL and the code path producing it. Check redirects: an initial HTTPS URL can redirect to HTTP, and an image or SDK endpoint may differ from the main API.

For local development, distinguish your computer's loopback address from the emulator or device's own loopback address. Changing the manifest cannot make the wrong host reachable.

Prefer a domain exception

The application can reference a resource in res/xml/network_security_config.xml:

<application
    android:networkSecurityConfig="@xml/network_security_config"
    ... />

An illustrative configuration keeps the default restricted and permits a development host only:

<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
    <domain-config cleartextTrafficPermitted="true">
        <domain>dev.example.test</domain>
    </domain-config>
</network-security-config>

Use a host you control. This example does not create DNS or grant production approval for HTTP. Prefer placing development-only rules in a debug source set so the release artifact cannot inherit them accidentally.

Understand which rule wins

Defaults depend on the app's target API and the device version. On Android versions supporting Network Security Configuration, a referenced configuration can govern the cleartext decision rather than the broad manifest flag. Library behavior also matters; do not assume every native networking implementation checks the platform policy.

Consult the current platform documentation for the version combinations you support instead of copying a manifest workaround from an older target SDK tutorial.

Verify the built release

Inspect the merged release manifest and the packaged XML, not only the source file open in the editor. A product flavor or dependency may alter the effective configuration. Test that the authorized development path works only in the intended build and that unrelated HTTP requests remain blocked.

Use the checker for a focused review

The APKLint Cleartext Traffic Checker highlights broad allowances and configuration concerns. Treat its output as a review prompt. The decisive test is the behavior of the release build and the actual network client, including redirects and third-party SDK requests.