Security

Developer Mode is off by default. When the user enables it, SuperAge exposes a local HTTPS API intended for paired clients on the user's current local network.

Trust Model

• The app starts the local API only when Developer Mode is active.
• The API uses HTTPS.
• Scoped data requires per-client pairing and a Bearer token.
• Clients are scoped and can be revoked independently.
• Data endpoints are read-only in v1.
• The public site at dev.superage.app is documentation only.

Read-Only Boundary

Allowed data methods:

GET
HEAD
OPTIONS

The v1 API does not create, update, delete, import, recalculate, or trigger app data. Pairing endpoints may use non-read methods because they create credential state, not app or HealthKit records.

Network Availability

iOS may suspend the app while it is not active. Developer Mode does not promise background server availability. If the local API is unreachable, open SuperAge and verify Developer Mode is still active.