Report a security vulnerability

Lampsy® watches over people while they sleep, so we take the security of our device, app and website seriously. If you think you have found a weakness, please tell us.

How to report

Email security@lampsyhealth.com with what you found, where, and the steps to reproduce it. Screenshots or a short proof of concept help. Please include no more personal data than you need to show the problem.

In scope

lampsyhealth.com and its subdomains, including the website and its API
The Lampsy® app for iOS and Android
The Lampsy® device and its firmware

Out of scope

Denial-of-service tests, social engineering of our staff or customers, physical attacks, spam, and automated scanner output without a demonstrated impact. Issues in services we use, such as Stripe, go to them directly.

What we ask

Give us reasonable time to fix the issue before sharing it publicly.
Access only what you need to show the problem: never view, change or delete other people's data, and if you come across any, stop and tell us.
Don't disrupt our service or our users.

What we commit to

We acknowledge every report within 5 working days and keep you informed until it's fixed.
If you act in good faith and follow this policy, we will not take legal action against you for your research.
With your permission, we'll credit you once the fix is out.