Humble Bundle, the PC storefront behind various charity game bundles, has been updated with what appears to be an all-new vibe-coded redesign, and it seems to be extremely flawed. As a few people have noted, the update appears to have stripped the site of various security features that could put user accounts and saved credit card information at risk.
Initially discovered by users on Reddit, the update has entirely removed the option for two-factor authentication—which appears to be true for all users: when logging into my own account, the choice to add or remove the feature is entirely missing under security settings. People are reporting myriad other issues, including errors preventing their purchasing new bundles. Various standard security features are missing following the new update: there are no authentication checks when changing passwords or email addresses, potentially making it easier for anyone to gain control of an account without a user’s permission. If logged in you can simply enter a new password without having to know the current one. Additionally, when attempting to change your email addresses, no verification is sent to the old email address, with information only being directed towards the newly-inputted email account. We’ve tested this too, and incredibly it’s the case.
Beyond security issues, many have complained about a host of features previously on the site being removed or obfuscated in the shift to “vibe-coded brainrot.” Some have noticed that there’s no longer differentiation between redeemed and unredeemed games and codes, making it harder for users with large libraries to sort through their purchase history and find unclaimed games. There’s also no way to remain logged-in, forcing users to log in every time they access their library. Others simply dislike the new design as appearing reminiscent of other Claude interfaces.
Though some are hoping for a return to the old design, many are more notably concerned by the security issues introduced with this update. For now, it’s recommended to remove any payment information saved to your Humble account in case of unauthorized access, at least until these issues are resolved. Hopefully that won’t take too long. It’s not like this is the first time a vibecoded redesign hasn’t turned out quite how the developers had hoped.
We’ve reached out to Humble, owned by IGN, to ask for comment.