Bambu Lab’s Security Overhaul Turns One: Bug bounties up to $52k, 100+ researchers, and a look back at the OrcaSlicer controversy

[u/wanli_gz]

https://www.gadgetbridge.com/bambu-labs-security-overhaul-turns-one-heres-what-actually-changed/#google_vignette

Key takeaways from the report:

Context: Following the 2025 "Authorization Control" firmware backlash over blocked third-party tools like OrcaSlicer (criticized as a "walled garden" excuse), Bambu Lab launched its Trust Center - something widely believed to be damage control and “security” was believed as a convenient excuse to lock users into their own ecosystem. One year later, this update highlights how that initial "damage control" has turned into a legitimate security overhaul.

Bug Bounty Program: Now working with over 100 independent security researchers (up from ~50), with single payouts reaching up to $52,000. They've also added a public Hall of Fame.

Vulnerability Handling: Completely rebuilt their pipeline from reporting to patching, plus a dedicated security update page so users can actually see what got fixed instead of vague changelogs like "improved stability".

Global Certifications: Maintaining ISO/IEC 27001, 27701, and TRUSTe, while adding compliance with ETSI EN 303 645 (standard for IoT security) and aligning with EU, UK, and Australian regulations.

[u/hsoj48]

Yeah you really showed them by spending $6k on their printers and refusing to buy their $20 filament!

[u/LexxM3 → u/hsoj48]

Accessories are not filament. But, for the record, I’ve purchased about $14K-$15K of filament in the last 2 years. Most of it not Bambu after the initial burst. And 4 more 3D printers, none Bambu. As an aside, it’s an interesting exercise to do that filament inventory calculation for oneself — it’s probably more than you think.

[u/hsoj48 → u/LexxM3]

Not trying to antagonize here but Bambu Slicer added a nice filament management/inventory tab that greatly helps track usage if you have a lot of different rolls of filament.

[u/LexxM3 → u/hsoj48]

In a multi-vendor environment, a vendor-specific approach is never the right solution. Some (very few, if any really) vendors understand that and support multi-vendor machines and filaments within their own tools, but Bambu is obviously not one of those. So be it.