NSAllowsLocalNetworking ships in Release builds

[jbrahy]

ios/SpamFilter/Info.plist sets:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsLocalNetworking</key>
    <true/>
</dict>

That exists so Debug builds can reach http://localhost:8080. But Info.plist is shared across configurations, so it ships in Release too — including to TestFlight and eventually the App Store.

It only relaxes ATS for local and private-network addresses, not arbitrary insecure traffic, so this is not a hole. But an App Review reviewer may ask, and a privacy-first app carrying an unnecessary ATS exception is worth avoiding on principle.

What to do

Make it configuration-specific. ios/project.yml already does per-config settings for the app target (see the debug / release blocks added for SPAMFILTER_API_BASE_URL and CODE_SIGN_ENTITLEMENTS), so the pattern is established: supply two plists, or use an INFOPLIST_KEY_* override where possible.

Verify by unpacking the built Release IPA and confirming the key is absent:

unzip -q build/export/SpamFilter.ipa -d /tmp/check
plutil -p /tmp/check/Payload/*.app/Info.plist | grep -A3 NSAppTransportSecurity

Remember ios/SpamFilter.xcodeproj is generated — edit ios/project.yml and run xcodegen generate.