Security incident · checklist estimated
Humble Bundle just killed most of their security through vibecoding
Tier C · Keep an eye on it – Check if you’re affected
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Use a unique, strong password for your Humble Bundle account.
- Review automatic payment authorizations linked to Humble Bundle in PayPal or your card provider, as one commenter did.
The Brief
- A post on Hacker News says the redesigned Humble Bundle site dropped two-factor authentication at login, so a password alone is reportedly enough to sign in.
- Commenters quoting the article say one-click payments are enabled and that the password can be changed without entering the current one.
- The article is said to attribute the changes to vibecoding, but commenters note it provides no direct proof of how the site was built.
Why it matters
If the reported changes are accurate, a Humble account protected only by a password is easier to take over, and any stored payment method may be charged with less friction.
The checklist behind the tier
Checklist · 1 of 10 yes · estimated from older data, not yet checked against the sources
| Yes | Hits tech teams | Does it affect software, devices or services that developers, ops or IT teams build with, run or are responsible for? |
| No | Core infrastructure | Is the flaw in, or the compromise of, software that nearly every team runs? |
| No | Popular tool | Is the flaw in, or the compromise of, a widely used framework, tool, platform, OS or package? |
| No | Exploited in the wild | Do sources report real attacks using it? |
| No | Public exploit | Is a working exploit or detailed proof-of-concept public? |
| No | Remote, no login | Can an attacker use it over the network without credentials or user interaction? |
| No | Full takeover | Does it lead to code execution, root/admin rights or full account takeover? |
| No | Secrets exposed | Were credentials, tokens, keys, configs, source code or customer data stolen or exposed? |
| No | Supply chain | Was malicious code shipped through a channel developers trust? |
| No | No fix yet | Is there no patched version yet? |
Timeline
Source
Humble Bundle just killed most of their security through vibecoding ↗ Hacker News: Front Page · 9h ago
What developers are saying
Based on 196 comments · Mostly critical
Commenters are largely negative about the redesigned Humble Bundle site, citing the removed 2FA, slow email login codes, missing order history and difficulty deleting accounts. Opinion is split on whether AI is to blame, with several arguing that poor software comes from people rather than tools, and others noting that the article offers no direct proof of vibecoding.
- Blame lies with developers25%
- Removed 2FA and weak login30%
- Broken downloads and order history20%
- Unproven vibecoding claim15%
- Subscriber trust eroded20%
In favour
- + Some commenters say AI tools can run thorough checks, which would have caught several of these issues.
Concerns
- − Two-factor authentication reportedly removed from login.
- − One-click payments reportedly enabled.
- − Password can reportedly be changed without the current password.
- − Login codes arrive by email late or not at all for some users.
- − Downloads of purchased games and ebooks reportedly fail or have been removed.
- − Order history reportedly missing for some users.
- − Account deletion reportedly difficult to complete.
“AI doesn't produce bad software, people do.”
“The article doesn’t seem to provide any direct proof the new site was vibecoded?”
“Can someone there please just click the rollback button now and we can all forget this ever happened.”
First seen · 1 source · 196 comments · Full story page · How tiers are decided