"Humble Bundle just killed most of their security through vibecoding"

xx__yy

Sounds like shotgun project, cheap model with low effort, at the controls of someone who doesn't know how to build software, end to end. AI doesn't produce bad software, people do.

aurareturn

Why blame vibe coding? It's always up to the skill of the human.

xavdid

Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.

mococa

They fired their devs and put marketing people to code

Ekaros

Perfect example of when rewrite is functionally worse for users and done for sake of doing it... I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...

rozenmd

"A computer can never be held accountable, therefore a computer must never make a management decision"

gabucino

>To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there. i thought i'd be hearing about downsides?.. elaborate plz

agilob

> so bad that they have one-click payments enabled (which is illegal) for purchases. Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?

dava96

I wonder if the issues I was having trying to download my ebooks from them is related to "vibe coding". It was pretty frustrating not being able to download the things I'd paid for.

bronlund

I hate on hover menus with a passion.

aeQu5igh

They deleted the download link for the original humble bundle. I can no longer download Gish.

jjbinx007

Thanks for this. Been a Humble subscriber for years but this has just persuaded me to cancel

brindleth

The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along. Without evidence, accusations like this are, ironically, just vibes-based.

DuncanCoffee

If you try to log in, it gives you three captchas, once when you input your username and twice when you input your password lmao. I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point. Cannot wait for some insider to tell us the story of how this came to be

anilakar

Humble hasn't been humble since the IGN acquisition. Maybe they should finally change name to Edgy Bundle.

origini

At least 2fa got removed. Man i hate this, every single shit wants 2fa. Let me do 2fa when i have to pay not to just login to services i care very little. And yes blizzard my wow account is not worth anything either.

trvz

This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple. I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.

1313ed01

Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think. If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.

scaglio

For anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/

nyktas

After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly. It showed me that they just don't care anymore. But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.