Removing network security config which has no use

[seventhmoon]

the following network security config has no use and should be removed

    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">secure.example.com</domain>
    </domain-config>

[catcutecat]

We do use this config file when generating aab files for Play Console. However, we do not provide the server domain URLs in this open-source project.

[seventhmoon]

I understand that you may have some other configuration which is not in this repo.
But do you agree that <domain includeSubdomains="true">secure.example.com</domain> has no use here?

[catcutecat]

Yes, I agree that <domain includeSubdomains="true">secure.example.com</domain> has no functional use here. The concern is that we want to let people know the implementation of this app as much as possible. How do we let people know we will have this network security config for the Play Store version? Maybe we can add some comments here or do you have any other advice?

[seventhmoon]

Network Security Config is in API level 24 and higher (current min is 23).
How is that being handled in API 23?

About the API endpoints, it is easy to know if there is a proxy to monitor the network traffic.
So, hiding it or not is no big differences.

[catcutecat]

Network Security Config is in API level 24 and higher (current min is 23).
How is that being handled in API 23?

We do not consider API 23 in this case yet.

About the API endpoints, it is easy to know if there is a proxy to monitor the network traffic.
So, hiding it or not is no big differences.

Yeah, no big difference but still has some difference 😂.
This is a kind of policy in our team.