xcode/app-transport-security
Refuses a property list that allows arbitrary loads, which turns transport security off for every host.
Part of the xcode configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
Arbitrary loads let the app send plain HTTP to any host, and one forgotten debug setting ships that.
What to do
Section titled “What to do”Remove the key, and add an exception for the one host that needs it.
Example
Section titled “Example”An Info.plist with NSAllowsArbitraryLoads reports a finding. Remove the key, and add an exception only for a host that needs one.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore xcode/app-transport-security --paths "<glob>" --reason "<why>"