SleepEngine™ Puck (model SE-EU-003) — how to report a security vulnerability to Cambridge Sleep Sciences Ltd.
Report a vulnerability
If you believe you have found a security vulnerability in the SleepEngine™ Puck or its associated apps and services, please contact us at:
security@sleepengine.com| Product | SleepEngine™ Puck |
|---|---|
| Model | SE-EU-003 |
| Manufacturer | Cambridge Sleep Sciences Ltd (company no. 12401790) |
| Registered office | 115b Innovation Drive, Milton, Abingdon, England, OX14 4RZ |
| Security contact | security@sleepengine.com |
| Version | 1.0 · Effective 8 June 2026 |
1. Purpose
Cambridge Sleep Sciences Ltd takes the security and privacy of its users seriously. This policy explains how security researchers, users, customers and partners can report potential vulnerabilities affecting the SleepEngine™ Puck, model SE-EU-003, and its associated mobile applications and update services.
2. How to report a vulnerability
Reports should be sent to security@sleepengine.com. Please include, where possible:
- The affected product, model, software version, app version or service.
- A clear description of the suspected vulnerability.
- Steps to reproduce the issue, including screenshots, logs or proof-of-concept material where appropriate.
- Whether the issue may expose personal data, device control, Wi-Fi credentials, update behaviour or account access.
- Your contact details if you would like acknowledgement and status updates.
3. Response process
- Acknowledgement: we aim to acknowledge receipt of a vulnerability report within 48 hours.
- Initial review: we aim to provide an initial assessment or status update within 7 calendar days of acknowledgement.
- Remediation: confirmed issues will be investigated, prioritised and remediated according to severity, exploitability and user impact.
- Communication: where appropriate, we will provide updates to the reporter while maintaining the security of users and systems.
4. Safe harbour
We support responsible security research. We will not pursue legal action against reporters who act in good faith, avoid accessing or modifying user data, avoid service disruption, do not publicly disclose details before a fix is available, and comply with applicable law.
5. Out-of-scope activity
- Social engineering, phishing or physical attacks against staff, partners or users.
- Denial-of-service testing or activity that degrades production systems.
- Accessing, modifying, deleting or exfiltrating user data.
- Testing against systems or products not owned or operated by Cambridge Sleep Sciences Ltd.
6. Product-security commitment
For the SleepEngine™ Puck (SE-EU-003), Cambridge Sleep Sciences Ltd maintains product-security processes covering pairing, device control, software updates and vulnerability handling. Security update information is published separately on our Security Update Commitment page.
Related Security Update Commitment → How long we provide security updates for the SleepEngine™ Puck and what they cover.Cambridge Sleep Sciences Ltd · SleepEngine™ Puck SE-EU-003 · PSTI documentation · Version 1.0, effective 8 June 2026.