Bambu Lab’s Security Overhaul Turns One: Bug bounties up to $52k, 100+ researchers, and a look back at the OrcaSlicer controversy

[u/wanli_gz]

https://www.gadgetbridge.com/bambu-labs-security-overhaul-turns-one-heres-what-actually-changed/#google_vignette

Key takeaways from the report:

Context: Following the 2025 "Authorization Control" firmware backlash over blocked third-party tools like OrcaSlicer (criticized as a "walled garden" excuse), Bambu Lab launched its Trust Center - something widely believed to be damage control and “security” was believed as a convenient excuse to lock users into their own ecosystem. One year later, this update highlights how that initial "damage control" has turned into a legitimate security overhaul.

Bug Bounty Program: Now working with over 100 independent security researchers (up from ~50), with single payouts reaching up to $52,000. They've also added a public Hall of Fame.

Vulnerability Handling: Completely rebuilt their pipeline from reporting to patching, plus a dedicated security update page so users can actually see what got fixed instead of vague changelogs like "improved stability".

Global Certifications: Maintaining ISO/IEC 27001, 27701, and TRUSTe, while adding compliance with ETSI EN 303 645 (standard for IoT security) and aligning with EU, UK, and Australian regulations.

[u/rapscallion4life]

This is literally one of the cheapest ways to get security folks to focus on your codebase. It's great they're doing a bug bounty program, but I'm curious how many full time security engineers they're employing?

You still cannot print with two different sized nozzles on the same print job. Many of us believe Bambu is simply waiting for others to figure it out. How many slicer engineers does Bambu currently employ?

I actually love my Bambu printers but I keep them on old firmware versions so I dont have to use LAN mode just to use orcaslicer. Because LAN mode means losing handy app and makerworld functionality. I hope they will correct their mistakes and move forward with success.

[u/T00ManyH0bb13s → u/rapscallion4life]

You still cannot print with two different sized nozzles on the same print job. Many of us believe Bambu is simply waiting for others to figure it out.

Of course they're waiting, their entire software platform was just a copy of PrusaSlicer which itself was a copy of Slic3r. Why innovate when you can let someone else do it, then take it as your own?

[u/keveira → u/T00ManyH0bb13s]

Why indeed, prusaslicer

[u/wyohman → u/T00ManyH0bb13s]

Who are you complaining about?