All network requests use HTTPS and App Transport Security is not disabled

App Transport Security (ATS) is Apple's network security framework — disabling it with NSAllowsArbitraryLoads: true in Info.plist allows all HTTP traffic, exposing users to man-in-the-middle attacks (CWE-319, OWASP A02 Cryptographic Failures). Apple requires a written justification for any ATS exception, and blanket disabling is frequently rejected without a compelling reason. HTTP API calls transmit auth tokens, personal data, and session information in cleartext — on public Wi-Fi, any observer on the network can read them. On Android, android:usesCleartextTraffic="true" in AndroidManifest.xml has the same effect.

Remove NSAllowsArbitraryLoads from Info.plist and migrate all API URLs to HTTPS.

// app.json — disable ATS exceptions
"ios": {
  "infoPlist": {
    "NSAppTransportSecurity": {
      "NSAllowsArbitraryLoads": false
    }
  }
}

For Android, add res/xml/network_security_config.xml:

<network-security-config>
  <base-config cleartextTrafficPermitted="false" />
</network-security-config>

If a specific third-party domain still requires HTTP (e.g., a local dev proxy), scope the exception to that domain only using NSExceptionDomains — never disable ATS globally. Update your backend's load balancer or CDN to enforce HTTPS if any production endpoint still accepts HTTP.