> Migrate the endpoint to HTTPS before submission. If you absolutely cannot (e.g. a third-party API you don't control)

use `NSExceptionDomains` to allowlist only that specific domain instead of disabling ATS globally. You'll still need to justify it in the review notes. Global `NSAllowsArbitraryLoads` without justific...