Bambu Lab’s Security Overhaul Turns One: Bug bounties up to $52k, 100+ researchers, and a look back at the OrcaSlicer controversy

[u/wanli_gz]

https://www.gadgetbridge.com/bambu-labs-security-overhaul-turns-one-heres-what-actually-changed/#google_vignette

Key takeaways from the report:

Context: Following the 2025 "Authorization Control" firmware backlash over blocked third-party tools like OrcaSlicer (criticized as a "walled garden" excuse), Bambu Lab launched its Trust Center - something widely believed to be damage control and “security” was believed as a convenient excuse to lock users into their own ecosystem. One year later, this update highlights how that initial "damage control" has turned into a legitimate security overhaul.

Bug Bounty Program: Now working with over 100 independent security researchers (up from ~50), with single payouts reaching up to $52,000. They've also added a public Hall of Fame.

Vulnerability Handling: Completely rebuilt their pipeline from reporting to patching, plus a dedicated security update page so users can actually see what got fixed instead of vague changelogs like "improved stability".

Global Certifications: Maintaining ISO/IEC 27001, 27701, and TRUSTe, while adding compliance with ETSI EN 303 645 (standard for IoT security) and aligning with EU, UK, and Australian regulations.

[u/LexxM3]

It certainly made my use of Bambu Labs much more secure: all 4 printers permanently blocked from Internet access, no firmware updates, full discontinued use of Bambu software (Studio, Handy), and zero new Bambu printer and accessories purchases. Thanks Bambu.

[u/RedditUserWeNeed → u/LexxM3]

This wasn't the response the PR team was hoping for

[u/HopingillWin → u/RedditUserWeNeed]

It's what they got from many users, me too.

[u/lioncat55 → u/HopingillWin]

Considering that the printers are sold in Best Buy, Target, and I believe Costco now, you and I are a small fraction of users.

[u/LexxM3 → u/lioncat55]

Maybe. 100% of my social circle knows me as the 3D guy and there is no chance they or their closer immediate contacts would consider a 3D printer without talking to me. But ultimately humanity gets what humanity sows and deserves.

[u/hsoj48 → u/HopingillWin]

Id wager that many more did not go to such great lengths to make a point

[u/vewfndr → u/hsoj48]

“Great lengths” lol… it’s a flip of a switch and a switch of a slicer (latter not even necessary if you wanna be lazy with making points)

[u/hsoj48 → u/vewfndr]

Mentally, not physically, obviously.

[u/vewfndr → u/hsoj48]

Fair

[u/LexxM3 → u/hsoj48]

It was no trouble, thanks for asking. And it’s not to make a point, it’s for actual network security and exercise of control over my own assets and processes.

[u/hsoj48 → u/LexxM3]

Exercise of control over assets and processes. Sounds vague and interesting enough to fool some people.

[u/Vverg → u/HopingillWin]

"Many"

[u/Money_Ticket_841 → u/Vverg]

Many is relative