<?xml version="1.0" encoding="utf-8"?>
<!-- Vectrum is self-hosted, often on a home or office network without TLS, so plain HTTP is
     allowed. The sign-in screen warns before sending a password to a non-local http:// server. -->
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>