<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Release: HTTPS only, system CAs, no cleartext -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>

    <!-- Debug: also trust user-installed CAs (Charles Proxy, etc.) -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>
