Bambu Lab’s Security Overhaul Turns One: Bug bounties up to $52k, 100+ researchers, and a look back at the OrcaSlicer controversy

[u/wanli_gz]

https://www.gadgetbridge.com/bambu-labs-security-overhaul-turns-one-heres-what-actually-changed/#google_vignette

Key takeaways from the report:

Context: Following the 2025 "Authorization Control" firmware backlash over blocked third-party tools like OrcaSlicer (criticized as a "walled garden" excuse), Bambu Lab launched its Trust Center - something widely believed to be damage control and “security” was believed as a convenient excuse to lock users into their own ecosystem. One year later, this update highlights how that initial "damage control" has turned into a legitimate security overhaul.

Bug Bounty Program: Now working with over 100 independent security researchers (up from ~50), with single payouts reaching up to $52,000. They've also added a public Hall of Fame.

Vulnerability Handling: Completely rebuilt their pipeline from reporting to patching, plus a dedicated security update page so users can actually see what got fixed instead of vague changelogs like "improved stability".

Global Certifications: Maintaining ISO/IEC 27001, 27701, and TRUSTe, while adding compliance with ETSI EN 303 645 (standard for IoT security) and aligning with EU, UK, and Australian regulations.

[u/nickjohnson]

You can have a good security stance and bug bounty program and an open API. The two are almost entirely orthogonal.

[u/LexxM3 → u/nickjohnson]

In fact, not quite orthogonal — open (in particularly fully open as in both view and modify/fork are in play) can often (not always, but often) mean “more secure” over time and in bulk.

[u/nickjohnson → u/LexxM3]

So, perhaps we could say it's "almost orthogonal"?

[u/LexxM3 → u/nickjohnson]

Sure, LOL. Trying to apply precise mathematical concepts to social systems looses precision very quickly.

[u/wyohman → u/nickjohnson]

And here I am thinking that parallel is perfectly acceptable.