# xcode/app-transport-security

> Refuses a property list that allows arbitrary loads, which turns transport security off for every host.

Refuses a property list that allows arbitrary loads, which turns transport security off for every host.

Part of the [`xcode`](/reference/configurations/xcode/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

Arbitrary loads let the app send plain HTTP to any host, and one forgotten debug setting ships that.

## What to do

Remove the key, and add an exception for the one host that needs it.

## Example

An Info.plist with `NSAllowsArbitraryLoads` reports a finding. Remove the key, and add an exception only for a host that needs one.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore xcode/app-transport-security --paths "<glob>" --reason "<why>"
```