vetkit.android.network.cleartext-base-config

The Android network security config permits cleartext HTTP for every domain (<base-config cleartextTrafficPermitted="true">).

Last updated: 2026-11-01

Suite: Security

xml

The Android network security config permits cleartext HTTP for every domain (<base-config cleartextTrafficPermitted="true">).

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Keep the base configuration HTTPS-only and allow cleartext only for specific hosts in a domain-config.

References

https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted

Source: packages/engine/rules/sast/mobile.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.