<?xml version="1.0" encoding="utf-8"?>
<!--
    Network security configuration.
    - Production: only HTTPS to cepi.com.pk
    - Development: allow cleartext to localhost/10.0.2.2 for emulator testing
-->
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">cepi.com.pk</domain>
    </domain-config>

    <!-- Local dev only — remove for release builds -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
