Humble Bundle redesign strips 2FA and password confirmation

Humble Bundle rolled out a redesigned website this week. Its new login flow no longer asks for a second factor. A user can change the password without entering the old one. A user can change the email without a check sent to the old address. Kotaku's Alicia Haddick reported all three on 12 November 2026. The site's own users said the code reads like an AI assistant wrote it with no human read.

The story is worth reading for anyone whose own team uses an AI assistant on account or payment code. The lesson is older than the AI assistant, and the pattern is what the AI assistant makes worse.

What Kotaku documented

Kotaku lists three faults on the live site. Two-factor authentication is gone from the login flow and from the account settings page. A logged-in user can type in a new password without entering the current one. A logged-in user can set a new email without a code sent to the old one. "The update appears to have stripped the site of various security features," Kotaku writes. The outlet adds that saved card details and user accounts are now at risk.

The outlet says it has asked Humble Bundle for comment and had not had a reply at publication. Humble Bundle is owned by IGN.

Why the vibecoding label stuck

The redesign reached users on 11 November. A Pirate Software post on X called out the missing two-factor the same day. The forum thread on SpaceBattles that collected the details ran to 283 points on Hacker News by the next morning. Commenters named the pattern vibecoding, the slang for releasing what an AI assistant wrote without reading it carefully.

Kotaku does not say AI wrote the redesign. The outlet writes that the new look is "reminiscent of other Claude interfaces". That is the article's own wording. No internal engineer has gone on the record about how the code was produced. The label sticks because the faults read like that pattern: three separate security paths broken in the same release, each one a single line of missing guard.

What a user should do today

Kotaku's advice is direct. Take any saved payment card off the account until the checks come back. Watch the email on file for a password or email change you did not ask for. A careful reader will also treat the Humble email address as leaked. Password-reuse attempts on other services use lists like that.

The lesson for a team using an AI assistant on account code

An AI assistant can write a password-change endpoint in a few minutes. It will write one that works. It will also leave out the current-password check, the rate limit and the email verification by default. A real production endpoint needs all three. Those checks are not in the straight-line answer to "add a password change page". They are in the pre-release checklist a careful team keeps for every login path.

The fault is not the AI assistant. The fault is removing the human read on login code because the AI assistant was quick. The faster the first draft arrives, the more tempting that removal is. The rule that has to hold is the opposite one. A release that touches two-factor, password or email changes needs a named person to sign off. The checklist should be the same one that was in place before.

Source

Alicia Haddick, Kotaku. The community thread the outlet draws on is the SpaceBattles post.