Harden Network Security

Background: Native [platform] app talking to [your API / third-party
APIs]. Current transport security: [HTTPS only? pinning? unknown].

Use case: Harden the network layer against interception and
man-in-the-middle attacks.

Implementation details:
- Enforce TLS everywhere: iOS App Transport Security with no broad
  exceptions; Android Network Security Config with cleartext disabled
- Certificate or public-key pinning for your own API—with the operational
  plan for rotation so pinning doesn't brick the app when certs change
- Validate server certificates properly (never disable validation, even
  in debug shortcuts that might ship)
- Don't log sensitive request/response data; strip auth headers from logs
- Consider the tradeoffs: pinning raises security but adds rotation risk

Deliverable: The transport-security configuration per platform, a
pinning approach with a concrete rotation/backup-pin plan, the
logging-redaction rules, and the debug-vs-release configuration so
shortcuts never reach production.