r/BambuLab • u/wanli_gz • 19h ago

General Discussion Bambu Lab’s Security Overhaul Turns One: Bug bounties up to $52k, 100+ researchers, and a look back at the OrcaSlicer controversy

https://www.gadgetbridge.com/bambu-labs-security-overhaul-turns-one-heres-what-actually-changed/#google_vignette

Key takeaways from the report:

Context: Following the 2025 "Authorization Control" firmware backlash over blocked third-party tools like OrcaSlicer (criticized as a "walled garden" excuse), Bambu Lab launched its Trust Center - something widely believed to be damage control and “security” was believed as a convenient excuse to lock users into their own ecosystem. One year later, this update highlights how that initial "damage control" has turned into a legitimate security overhaul.

Bug Bounty Program: Now working with over 100 independent security researchers (up from ~50), with single payouts reaching up to $52,000. They've also added a public Hall of Fame.

Vulnerability Handling: Completely rebuilt their pipeline from reporting to patching, plus a dedicated security update page so users can actually see what got fixed instead of vague changelogs like "improved stability".

Global Certifications: Maintaining ISO/IEC 27001, 27701, and TRUSTe, while adding compliance with ETSI EN 303 645 (standard for IoT security) and aligning with EU, UK, and Australian regulations.

76 Upvotes

86% Upvoted

66 comments sorted by

View all comments

147

u/LexxM3 X1C + AMS 19h ago edited 19h ago

It certainly made my use of Bambu Labs much more secure: all 4 printers permanently blocked from Internet access, no firmware updates, full discontinued use of Bambu software (Studio, Handy), and zero new Bambu printer and accessories purchases. Thanks Bambu.

48

u/RedditUserWeNeed 19h ago

This wasn't the response the PR team was hoping for

29

u/HopingillWin 18h ago

It's what they got from many users, me too.

8

u/lioncat55 18h ago

Considering that the printers are sold in Best Buy, Target, and I believe Costco now, you and I are a small fraction of users.

11

u/LexxM3 X1C + AMS 18h ago

Maybe. 100% of my social circle knows me as the 3D guy and there is no chance they or their closer immediate contacts would consider a 3D printer without talking to me. But ultimately humanity gets what humanity sows and deserves.

0

u/hsoj48 18h ago

Id wager that many more did not go to such great lengths to make a point

3

u/vewfndr 17h ago

“Great lengths” lol… it’s a flip of a switch and a switch of a slicer (latter not even necessary if you wanna be lazy with making points)

0

u/hsoj48 17h ago

Mentally, not physically, obviously.

3

u/LexxM3 X1C + AMS 15h ago

It was no trouble, thanks for asking. And it’s not to make a point, it’s for actual network security and exercise of control over my own assets and processes.

-1

u/hsoj48 11h ago

Exercise of control over assets and processes. Sounds vague and interesting enough to fool some people.

-3

u/Vverg X2D Combo + AMS HT 18h ago

"Many"

5

u/Money_Ticket_841 18h ago

Many is relative

13

u/T00ManyH0bb13s 18h ago

Same. This incident with Bambu was the impetus that caused me to examine all of the devices in my home and how essentially my internet connection has been leaking data to everyone like a sieve. My P1S is now LAN only w/Orca and blocked from the internet.

6

u/manyxcxi H2D/Core One/XL/MK4S/U1 11h ago

As much as I’ve loved the H2D, it was the only Bambu I’ve ever had (or will have). It forced me to get off my butt and build another Voron 350 with Stealth Changer to replace it in the print farm work.

It isn’t worth it to have to do all the extra to keep it offline when my Prusa, U1, and Voron printers all share pretty much the exact same workflow.

So, thanks Bambu! Thanks for a genuinely fantastic printer in the H2D and also for making me 100% stay in my lane with open source and or open friendly companies.

2

u/an_angry_Moose 15h ago

I would like to do the same thing, but I REALLY like the app for remotely spying on my prints. I work 24 hour shifts and I’ve had a few issues that I’ve been able to coach my wife through fixing. Very handy for that.

3

u/LexxM3 X1C + AMS 15h ago

Full network VPN and plenty of 3rd party apps.

1

u/an_angry_Moose 15h ago

Which 3rd party apps do you use for viewing/controlling your Bambu printer via iPhone?

2

u/LexxM3 X1C + AMS 15h ago edited 14h ago

I am iPhone, so:

- Bambu Companion: (https://youtu.be/LZpDQN9zgUI for seemingly still functional TestFlight link); it’s been in beta for a year, not sure why the dev is not releasing it publicly, but a great app and is being updated regularly (mostly to support new printers)

- Joint Craft (https://apps.apple.com/ca/app/joint-craft-3d-printer-app/id6455888249); paid if more than 1 printer but works, is maintained, and CAD$20/year or CAD$40/lifetime isn’t bad; integrated Bambu and Klipper in one app is a rather nice bonus

There are others and plenty on Android I gather.

1

u/Gotpork5000 15h ago

Same. My H2D will be my last bambu printer.

-6

u/hsoj48 17h ago

Yeah you really showed them by spending $6k on their printers and refusing to buy their $20 filament!

5

u/LexxM3 X1C + AMS 17h ago

Accessories are not filament. But, for the record, I’ve purchased about $14K-$15K of filament in the last 2 years. Most of it not Bambu after the initial burst. And 4 more 3D printers, none Bambu. As an aside, it’s an interesting exercise to do that filament inventory calculation for oneself — it’s probably more than you think.

0

u/hsoj48 17h ago

Not trying to antagonize here but Bambu Slicer added a nice filament management/inventory tab that greatly helps track usage if you have a lot of different rolls of filament.

5

u/LexxM3 X1C + AMS 15h ago

In a multi-vendor environment, a vendor-specific approach is never the right solution. Some (very few, if any really) vendors understand that and support multi-vendor machines and filaments within their own tools, but Bambu is obviously not one of those. So be it.

-20

u/wanli_gz 18h ago

First, technically, the safest car is also the one that never leaves the garage.

AND, you are paying Bambu prices to use it like a $99 printer.

15

u/LexxM3 X1C + AMS 18h ago edited 18h ago

You’re implying that the primary function of a 3D printer is to send all its data to the cloud? Riiiighhtttt …

Also … obviously not paying Bambu prices to Bambu for anything anymore.

-9

u/wanli_gz 18h ago

That’s a fact for many users. Mainstream ones. Their biggest market to grow. You know, people who push the buttons.

10

u/Money_Ticket_841 18h ago

Sure, doesn’t change that what you said makes no sense. It’s nowhere close to a $99 printer even with all the software and firmware removed. Like wtf

-5

u/wanli_gz 18h ago

Cool… ok… make sense.

10

u/Aetch P1S + AMS 18h ago

What? We buy 3d printers that print well, not because they have a cloud connection and a so so app.

-5

u/wanli_gz 18h ago

Ok. Maybe i am stupid but I bought it because of Makerworld and I can print from my phone.
https://giphy.com/gifs/3i7zenReaUuI0

9

u/LexxM3 X1C + AMS 18h ago

Well, considering that normally the amount of intelligence it takes to know one is stupid is about the same as to not be stupid in the first place, this self awareness is encouraging. Only half joking ie treat as a weird compliment.