v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.xml.android.nsc-cleartext-permitted

A network-security-config permits cleartext traffic (cleartextTrafficPermitted="true") in a <base-config> or in a <domain-config> that is not restricted to a loopback dev host.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

This lets HTTP run unencrypted for the covered domains, exposing OAuth tokens and API credentials to on-path capture (CWE-319). AI-generated configs enable this to unblock an http:// endpoint and leave it on for real hosts.

Set cleartextTrafficPermitted="false" (or rely on the API-28+ secure default). If cleartext is genuinely needed for local development, scope it to a <domain-config> that lists only loopback hosts (localhost / 10.0.2.2), which is not flagged.

VULNERABLE
vulnerable.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- ruleid: auth.xml.android.nsc-cleartext-permitted -->
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <!-- ruleid: auth.xml.android.nsc-cleartext-permitted -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">api.example.com</domain>
    </domain-config>
</network-security-config>
SAFE
safe.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- cleartext disabled globally: safe -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <!-- cleartext scoped to loopback dev hosts only: safe -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
        <domain includeSubdomains="true">10.0.2.2</domain>
    </domain-config>
</network-security-config>

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.xml.android.nsc-cleartext-permitted -- <reason>

References

https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted ↗https://cwe.mitre.org/data/definitions/319.html ↗