A read-only Apple Health token is a scope, not a label
Read-only is a claim. Scope is the proof. In a health-data agent setup there are two credentials people both call "the token", and they fail in different ways. The pairing secret gates the server. Turn on Agent pairing in the app and set PAIRING_SECRET in the server config. Without a match, every data tool answers "Locked" rather than returning an empty result. That distinction is deliberate: an empty result reads as "no data today", while "Locked" tells you the credential is the problem. The de
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.