Humble Bundle Gets a Vibecoded Appearance Overhaul and Forgets to Implement Full Account Security

Humble Bundle, the PC storefront behind various charity game bundles, has been updated with what appears to be a brand new flavor code overhaul, and it looks extremely flawed. As a few people have noted, the update appears to have stripped the site of various security features that could put user accounts and stored credit card information at risk.

Initially discovered by users on Reddit, the update removed the two-factor authentication option entirely, which appears to be true for all users: When logging into my own account, the choice to add or remove the feature is completely absent in the security settings. People are reporting myriad other issues, including errors that prevent them from purchasing new plans. Various standard security features are missing following the new update: There are no authentication checks when changing passwords or email addresses, potentially making it easier for anyone to take control of an account without a user’s permission. If you are logged in, you can simply enter a new password without having to know the current password. Additionally, when you attempt to change your email addresses, no verification is sent to the old email address, with information only directed to the newly entered email account. We also tested it, and it is incredibly so.

Beyond security concerns, many have complained about the removal or obfuscation of a host of features previously present on the site in the move to “vibration-coded brainrot.” Some have noticed that there is no longer a distinction between redeemed and unredeemed games and codes, making it more difficult for users with large libraries to sort through their purchase history and find unclaimed games. There is also no way to stay logged in, forcing users to log in every time they access their library. Others simply don’t like the new design because it’s reminiscent of other Claude interfaces.

While some are hoping for a return to the old design, many are particularly concerned about the security issues introduced by this update. For now, it is recommended that you delete all payment information stored in your Humble account in case of unauthorized access, at least until these issues are resolved. I hope it won’t take too long. It’s not like this is the first time a vibecoded overhaul hasn’t turned out exactly how the developers had hoped.

We contacted Humble, owned by IGNto request feedback.