Update: 2026-06-21 18:58:05

android_bot/app/build.gradle.kts

@@ -16,6 +16,7 @@ android {
         versionName = "1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        buildConfigField("String", "BOT_SECRET_KEY", "\"SIRO_BOT_SUPER_SECRET_123\"")
     }
 
     buildTypes {
@@ -36,6 +37,7 @@ android {
     }
     buildFeatures {
         compose = true
+        buildConfig = true
     }
 }
 

android_bot/app/src/main/AndroidManifest.xml

@@ -14,7 +14,7 @@
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.Android_bot"
-        android:usesCleartextTraffic="true">
+        android:networkSecurityConfig="@xml/network_security_config">
         <activity
             android:name=".MainActivity"
             android:exported="true"

android_bot/app/src/main/java/com/siro/android_bot/network/WorkerClient.kt

@@ -15,7 +15,9 @@ import javax.crypto.spec.SecretKeySpec
 class WorkerClient(private val context: Context) {
 
     private val TAG = "WorkerClient"
-    private val SECRET_KEY = "SIRO_BOT_SUPER_SECRET_123"
+    // TODO: Fetch this from server during first handshake instead of hardcoding
+    // For now, must match the BOT_SECRET_KEY env var on the server
+    private val SECRET_KEY = BuildConfig.BOT_SECRET_KEY
     
     // Read the real hardware Android ID
     val deviceId: String by lazy {

android_bot/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">location.intaleq.xyz</domain>
+        <domain includeSubdomains="true">intaleq.xyz</domain>
+        <domain includeSubdomains="true">siromove.com</domain>
+    </domain-config>
+</network-security-config>