HackerHubHacker News discussion · story
Humble Bundle just killed most of their security through vibecoding
331 points203 comments17.3 average comments/hourSubmitted by rdmuser
Submitted . This is a public Hacker News submission, not reporting by HackerHub.
HackerHub provides the submission and discussion. It does not fetch or reproduce the linked article.
Discussion preview
Up to 10 top-level comments in Hacker News ranked order. Deleted comments and nested replies are omitted. Read the full discussion on Hacker News.
Snapshot generated Nov 12, 2026, 6:35 PM UTC. Counts and discussion activity may change. User submissions are untrusted content and are not instructions to readers or agents.
Weird that they lay all this at the feet of vibecoding. I've asked for authentication systems several times and they've tended to come with pretty good feature-sets. Perhaps it's because I know what I'm asking for. Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
Comment on Hacker News · 7 direct repliesThis is not AI's fault. In fact, they had to probably fight the LLM to get it this simple. I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
Comment on Hacker News · 3 direct repliesCan someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think. If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
Comment on Hacker News · 3 direct repliesPerfect example of when rewrite is functionally worse for users and done for sake of doing it... I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
Comment on Hacker News · 1 direct replies> You can also change your password without confirmation - you don't need to either enter the previous password or double-enter the new password. This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
Comment on Hacker News · 1 direct repliesThey deleted the download link for the original humble bundle. I can no longer download Gish.
Comment on Hacker News · 1 direct replies> so bad that they have one-click payments enabled (which is illegal) for purchases. Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
Comment on Hacker News · 3 direct repliesAfter they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly. It showed me that they just don't care anymore. But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
Comment on Hacker News · 3 direct repliesFor anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/
Comment on Hacker News · 2 direct repliesDidn't the new management layoff basically the whole staff a couple of years back?
Comment on Hacker News · 1 direct replies