SuperDuper! 4

SuperDuper! 4.0.10 (October 8, 2026)

A security fix. This update fixes one problem, and I’d recommend installing it.

Security

Snapshots are now mounted at a private location while they’re being copied. When SuperDuper copies an APFS volume, it takes a snapshot and copies from that, so the backup reflects a single moment in time. While the copy ran, that snapshot was mounted in a location other software could reach.

macOS’s privacy protections (TCC) for things like Mail, Messages, and your Desktop and Documents folders are tied to where those files normally live. Because the snapshot presented the same files at a different location, software running under your account could read them there without having been granted Full Disk Access, for as long as the copy was running.

Files belonging to other users on the Mac were not exposed, and normal file ownership rules still applied, even for the current user.

To correct this problem, SuperDuper now mounts the snapshot inside a privileged folder only the root user can access. If that folder can’t be made private, SuperDuper copies from the live volume instead, as it already does when a snapshot can’t be taken.

A CVE identifier has been requested for this issue, but has not yet been assigned. These notes will be updated when it is.

Thanks to the user who reported it.

Requirements

The same as before: macOS 14 or later, including macOS 27 (Golden Gate), on Apple silicon or Intel.

SuperDuper! 4.0.9 (October 1, 2026)

Welcome to October!

SuperDuper 4 has been out for two months, with no major problems found, which is great.

But it does leave me with time to chase down incredibly obscure ones, and so…SuperDuper 4.0.9 fixes a few more network destination problems (so many worms in that particular can), improves copy status, and adds a new example logging Shortcut for your shortcutting pleasure.

Network destinations

Also, welcome to 1982. Legacy Humans, such as I, will feel some pangs of nostalgia about this one. Turns out, some NAS devices (like Synology) will write a file or folder named AUX, CON, NUL, PRN, COM1, but when you try to read it, it has been changed to a crazy name like AHY9U3~9.

Needless to say, this was inconvenient, and caused copies to fail (GarageBand actually has a folder called Aux in its app bundle).

SuperDuper now checks which of those names the destination can actually store and logs how many it skipped. (Which should be few-to-none.)

Hopefully this will make someone’s life a little less confusing.

Copies stop faster on error. After an error ended a copy, SuperDuper could still go on to the cleanup work at the end before reporting it. No longer.

Saved share passwords found! A password saved for a specific share (e.g. smb://server.local/share) could be missed, giving an error on connect if a password was needed.

Read-only folders on NAS devices. Welcome to Obscure Valley. To the left, note another SMB problem, where some Samba-based NAS devices exactly enforce a folder’s permissions, so removing something from inside a read-only folder could fail with “Permission denied”.

SuperDuper already unlocks those folders for the copy and puts them back afterwards, but immediately after reading a folder, macOS misreports its permissions, causing errors.

We’ll continue now to the right, on Workaround Lane.

macOS 27 vs. accented names. Further along the way, note that after updating to macOS 27, accented names (like Übersicht) written to NASen could fail with “No such file or directory”. We’ll once again take a trip further down Workaround Lane to avoid additional weird macOS regressions…at least until I find another one.

Permissions, measured. Rather than assume worst-case behavior on NAS devices, SuperDuper now checks the destination’s behavior at the start of a copy, which can speed up copies of lots of small files.

Progress and status

Cleanup at the end of a copy…cleaned up. After a copy, on a slow destination (like a NAS), the end-of-copy cleanup could say it was still scanning, when it wasn’t. It now shows “Removing N items…” while cleaning.

Interface

Phases, like elephants, no longer forget. Expanding a phase in a job to see its details now sticks. Each job remembers which phases you opened, even after you quit and relaunch SuperDuper.

You’re welcome, mjt!

Shortcuts

SuperDuper Backup Dashboard Shortcut available. There’s a new Log SuperDuper Backup to Dashboard Shortcut you can pick as a Run a Shortcut action. Once picked, it’ll ask you for various permissions, and to choose a folder for the dashboard. From then on, that job (and any other you select it for) adds a row to a Numbers spreadsheet in that folder when it runs.

If you pick an iCloud location for the document (the default), you can share this between Macs and they can all log to the same spreadsheet. You can even review it from an iPad, iPhone or browser.

At the top of the dashboard spreadsheet you’ll see one row per copy job: its name, how long since it last succeeded, its last result, how many times it has run and failed, and its average and most recent run time, with a chart comparing them. You can uncheck a job’s Show box to drop its runs from the table and charts below: that way, you can focus on one job, or compare a few.

Requirements

The same as before: macOS 14 or later, including macOS 27 (Golden Gate), on Apple silicon or Intel.