Disable cleartext traffic in the app's network security configuration, then reference that configuration from the manifest. `res/xml/network_security_config.xml`: ```xml <?xml version="1.0" encoding="utf-8"?> <network-security-config> <base-config cleartextTrafficPermitted="false" /> </network-security-config> ``` `AndroidManifest.xml`: ```xml <application android:networkSecurityConfig="@xml/network_security_config" ...> </application> ``` Also make every client URL use `https://`, avoid raw ...
Scanned 9/5/2026
Install to Claude Code
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill android-security --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Android Security?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-android-security-4cf1ec1d)More formats (shields.io, HTML) on the badges page.
# Enforce HTTPS
Disable cleartext traffic in the app's network security configuration, then reference that configuration from the manifest.
`res/xml/network_security_config.xml`:
```xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="false" />
</network-security-config>
```
`AndroidManifest.xml`:
```xml
<application
android:networkSecurityConfig="@xml/network_security_config"
...>
</application>
```
Also make every client URL use `https://`, avoid raw URL concatenation (use `Uri.Builder` or OkHttp's `HttpUrl`), and review redirects and third-party SDK endpoints so they cannot downgrade requests to HTTP. For a high-security app, consider certificate pinning for controlled domains, with a documented rotation/expiry strategy. Never log tokens or other sensitive request data.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
