Designed to keep printer access on your network.
LayerGlance, LayerGlance Touch, LayerGlance Glow and LayerGlance Bridge do not need a Bambu Cloud account. They talk to your printers on your local network and never send printer credentials to us. Printer set-up requirements are on the compatibility page.
- 01PrinterLocal LAN status
- 02Your networkNo Bambu Cloud login
- 03Your viewApp, Touch or Glow
On supported printer firmware, neither Developer Mode nor LAN Only Mode is required. Your printer can stay connected to Bambu Cloud for Bambu Handy and Bambu Studio while LayerGlance reads its status locally. LayerGlance does not change your printer's connection mode.
Printer monitoring uses the local LAN interface Bambu Lab publicly describes. It works only while the printer's firmware makes that interface available; Bambu may change, restrict or remove access. See how the connection works. Optional iPhone lock-screen updates use our push service and Apple's notification service, while the bridge reads printer status locally.
Device administration
Web password protection is optional, configured locally, and stored only on the controller. With protection off, anyone on the trusted LAN can administer the device. When enabled, local sessions expire and repeated logins are throttled. Settings changes always require a same-origin POST. Each device separately protects its setup Wi-Fi network with a per-device credential that a firmware-only customer retrieves locally over the USB console. Customer-download firmware verifies signed updates and retains previous-slot and full USB recovery. Because customers own and may need to recover their controllers, these downloadable builds deliberately do not enable ESP32 Secure Boot, flash/NVS encryption, or eFuse anti-rollback. Those irreversible controls exist only in separate factory-controlled profiles and are never offered by the browser installer.
LayerGlance Bridge
The setup interface accepts loopback connections only. Pairing codes are single-use and short-lived; screen tokens are random, stored as hashes, read-only, and revocable. Windows protects printer access codes with the current user's DPAPI key. Linux/Pi uses a locked-down service account and a mode-0600 configuration file.
Network boundary
Use a trusted private LAN or isolated IoT VLAN and never expose a controller or LayerGlance Bridge port to the internet. Device web pages and the paired-screen feed use HTTP on the local network. Printer MQTT uses encrypted TLS, but current Bambu printer certificates cannot be validated against a public trust chain, so an active hostile LAN remains a risk.
Reporting a vulnerability
Email hello@fiddlercrab.eu with the subject "Security". Describe the product and version, the issue, its impact and the steps to reproduce it. Never send Wi-Fi passwords, printer access codes, web passwords, pairing tokens, Bambu account tokens, private keys, or unredacted print filenames in a report. Our security.txt lists the same contact.
Coordinated disclosure
- We confirm receipt within two business days and keep you informed while we investigate and fix the issue.
- Please give us reasonable time to release a fix before you publish details; we aim to fix issues within 90 days and will agree a disclosure date with you.
- We credit reporters in the advisory if they wish.
- We will not take legal action against good-faith research that stays within these rules: test only your own devices and installations, do not access other people's data or printers, and do not disrupt services.
- We publish fixed versions and, where relevant, an advisory with the affected and fixed versions.
Since 11 September 2026, we report actively exploited vulnerabilities and severe security incidents affecting our products as required by the EU Cyber Resilience Act.