Humble Bundle Undergoes A Vibe-Coded Redesign, Forgets To Implement Full Account Security - Kotaku

본문

By Alicia Haddick Published November 12, 2026 | Comments (12) | 𝕏

A possibly AI-generated piece of artwork from the new store. © Humble Bundle

Humble Bundle, the PC storefront behind various charity game bundles, has been updated with what appears to be an all-new vibe-coded redesign, and it seems to be extremely flawed. As a few people have noted, the update appears to have stripped the site of various security features, potentially putting user accounts and saved credit card information at risk.

Initially discovered by users on Reddit, the update has entirely removed the option for two-factor authentication; when logging into my own account, the choice to add or remove the feature is entirely missing under security settings. People are reporting myriad other issues, including errors preventing them from purchasing new bundles. Various standard security features are missing following the new update: there are no authentication checks when changing passwords or email addresses, potentially making it easier for anyone to gain control of an account without a user’s permission. If logged in, you can simply enter a new password without having to know the current one. Additionally, when attempting to change your email addresses, no verification is sent to the old email address, with information only being directed toward the newly inputted email account. We’ve tested this too, and incredibly it’s the case.

Beyond security issues, many have complained about a host of features previously on the site being removed or obfuscated in the shift to “vibe-coded brainrot.” Some have noticed that there’s no longer differentiation between redeemed and unredeemed games and codes, making it harder for users with large libraries to sort through their purchase history and find unclaimed games. There’s also no way to remain logged in, forcing users to log in every time they access their library. And some simply dislike the new design for appearing reminiscent of other Claude-coded interfaces.

For now, it’s recommended to remove any payment information saved to your Humble account in case of unauthorized access, at least until these issues are resolved. Hopefully that won’t take too long. It’s not like this is the first time a vibecoded redesign hasn’t turned out quite how the developers had hoped.

We’ve reached out to Humble, owned by IGN, to ask for comment.