LaunchLint Academy
The short answer
HTTP exceptions may unblock development but can expose data and leave an overly broad production configuration. Prefer HTTPS and scope unavoidable exceptions to known destinations.
- Review iOS ATS, Android Network Security Config, WebViews, debug certificates, and actual endpoints together. A global allow rule is rarely the right fix.
Evidence required for release
Do not review ats, cleartext traffic, and network security configuration as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Keep three evidence layers separate for ATS, cleartext traffic, and network security configuration: statically visible project configuration, behavior on a clean device, and external settings in Apple Developer, App Store Connect, or Play Console. The review is reliable only when those layers describe the same release candidate. Give every mismatch an owner and a stop condition instead of assuming a default will be correct.
Evidence required for release
- Production value for inventory every endpoint identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
1. Inventory every endpoint
List APIs, authentication, media, WebViews, analytics, update, and support services including redirects and subdomains.
Do not review inventory every endpoint as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for inventory every endpoint identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
2. Understand the ATS default
Apple protects URL Loading System connections. Inspect NSAppTransportSecurity and avoid global exceptions.
Do not review understand the ats default as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for understand the ats default identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
3. Control Android cleartext
Review usesCleartextTraffic and any Network Security Config. Target API and networking library affect enforcement.
Do not review control android cleartext as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for control android cleartext identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
4. Scope exceptions narrowly
Allow HTTP or custom trust anchors only for specific domains and a documented purpose.
Do not review scope exceptions narrowly as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for scope exceptions narrowly identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
5. Separate debug from production
Local CAs, proxies, and development servers belong in debug overrides or separate builds.
Do not review separate debug from production as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for separate debug from production identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
6. Review WebViews separately
WebViews can load their own navigation, file URLs, and third-party content. Transport security does not replace a URL allowlist.
Do not review review webviews separately as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for review webviews separately identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
7. Test certificates and redirects
Check expiration, hostnames, intermediates, and redirects to HTTP with the final artifact.
Do not review test certificates and redirects as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for test certificates and redirects identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
8. Document residual risk
Every exception needs an owner, expiry date, affected data, alternative, and removal test.
Do not review document residual risk as an isolated switch. Connect it to ATS, cleartext traffic, and network security configuration, the signed production artifact, and the values in the store console. Record which file produces the setting, whether a framework or plugin can alter it during the build, and how you inspected the resolved value. A plausible entry in source control does not prove that the uploaded binary contains the same configuration.
Evidence required for release
- Production value for document residual risk identified
- Responsible project file or store setting linked
- Resolved native configuration inspected
- Signed artifact checked on a clean device
- iOS and Android differences recorded
- Every mismatch has an owner and stop condition
Frequently asked questions
Why does localhost work while production fails?
Debug settings, certificates, and platform rules differ. Test the production host in the signed build.
Should ATS be disabled globally?
Usually not. Fix the server or use a narrow, justified exception.
Is usesCleartextTraffic=false enough?
Not alone. Network Security Config, WebViews, and networking libraries also matter.
Can LaunchLint observe network traffic?
No. It detects static configuration and risky exceptions but never executes the app or observes runtime traffic.