<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!--
      Permit cleartext traffic for local network / user-defined hosts while maintaining secure defaults.
      Application-level checks in HermesRestClient and JsonRpcGatewayClient enforce explicit per-host user consent (allowCleartext flag).
    -->
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>
