# Can Android network_security_config.xml be bypassed?

**URL:** https://discuss.privacyguides.net/t/can-android-network-security-config-xml-be-bypassed/35971
**Category:** Questions
**Created:** 2026-03-05T07:43:16Z
**Posts:** 5
**Showing post:** 4 of 5

## Post 4 by @ignoramous — 2026-03-05T16:54:19Z

> [@Veilo](#):
>
> For example, if we configure [network\_security\_config.xml](https://developer.android.com/privacy-and-security/security-config) for our app to only connect to certain third party domains like OpenAI and Anthropic and block all others

What does the config to do this look like? From the linked documentation, it isn’t clear what you’re trying to accomplish is even possible.

The `<domain-config>` in `network_security_config.xml` is mostly intended to

- Amend the per-app _TrustAnchors_ (roots and/or intermediates which aren’t validated themselves but used to validate other intermediates / end entities) available in Android’s _default_ TrustStore (for PKI cert path building)
- Restrict cert validation to a handful of pinned certs.

I’ve not looked thoroughly, but from the API surface (in AOSP code), it looks like `network_security_config.xml` will only apply to Android apps using the Android SDK (Java / Kotlin) and not to C/C++/\<other code\> that may have to be compiled with the Android NDK (this is where I’d have tagged @anon63378630… alas).

---

_[View the full topic](https://discuss.privacyguides.net/t/can-android-network-security-config-xml-be-bypassed/35971)._