I just published an update for my android game to play store, and I found these two warnings :
Cleartext traffic allowed for all domains Your app's Network Security Configuration allows cleartext traffic for all domains. This could allow eavesdroppers to intercept data sent by your app. If that data is sensitive or user-identifiable it could impact the privacy of your users.
Consider only permitting encrypted traffic by setting the cleartextTrafficPermitted flag to false, or adding an encrypted policy for specific domains.
and
Your app accepts user certificates when verifying secure connections. Your app's Network Security Configuration allows the use of user-specified certificates. This could allow eavesdroppers to intercept data sent by your app, or to modify data in transit.
Consider nesting the trust-anchors element that allows user certificates inside a debug-overrides element to make sure they are only available when android:debuggable is set to true.
as shown in this photo:
I looked the internet for a solution, and one suggested I should add android:usesCleartextTraffic="false" to AndroidManifest.xml
If I were to go for that, I think I should enable "Custom Main Manifest" option in Unity Player / Publishing Settings. as shown here:
If you managed to solve this, We would really appreciate you sharing your solution. and maybe share your custom AndroidManifest after doing needed mods.
Thank You