The manifest sets android:usesCleartextTraffic="true" on <application>, re-enabling plaintext HTTP for the entire app.

Why this matters

Every network call, including OAuth token exchanges and API requests carrying bearer tokens, may then run over cleartext and be captured by an on-path attacker (CWE-319). On API 28+ cleartext is off by default; AI-generated manifests flip this flag back on to "fix" a connection to an http:// dev endpoint and ship it that way.

Remove the attribute (leave the secure default) or set it to false, and if a specific host genuinely needs cleartext during development, scope it with a network-security-config <domain-config> instead of enabling it app-wide.

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">
    <!-- ruleid: auth.xml.android.manifest-cleartext-traffic -->
    <application
        android:label="Example"
        android:usesCleartextTraffic="true"
        android:theme="@style/AppTheme">
        <activity android:name=".MainActivity" />
    </application>
</manifest>

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">
    <application
        android:label="Example"
        android:usesCleartextTraffic="false"
        android:theme="@style/AppTheme">
        <activity android:name=".MainActivity" />
    </application>
</manifest>

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.xml.android.manifest-cleartext-traffic -- <reason>

References