CommunityFragment.onViewCreated (app/src/main/kotlin/io/treehouses/remote/fragments/CommunityFragment.kt:34) loads the community map WebView with a cleartext URL:

bind.map.settings.javaScriptEnabled = true
//bind.map.loadUrl("https://www.google.com/maps/d/u/0/viewer?ll=11.88717970130264%2C10.93123241891862&z=4&mid=1rO3RmHQnrSNsBwB9skqHos970zI-ZVAA")
bind.map.loadUrl("http://maps.media.mit.edu/remote.html")

The page is currently fetched as http://maps.media.mit.edu/remote.html, and the app keeps it working only because AndroidManifest.xml declares android:usesCleartextTraffic="true" for the whole package. Cleartext over WiFi means anyone on the path can see which page is being viewed and can inject content into the map page that runs with JavaScript enabled (this is the CWE-319 pattern Mutchler et al. call out for hybrid Android apps).

maps.media.mit.edu already serves the same page over https://, so the swap is a one-character change with no behavioural difference. A long-term follow-up would be to drop the global usesCleartextTraffic="true" once every cleartext call site has migrated.

Suggested fix

- bind.map.loadUrl("http://maps.media.mit.edu/remote.html")
+ bind.map.loadUrl("https://maps.media.mit.edu/remote.html")

A PR with the one-line change is open at #2315.