Humble Bundle redesign removes two-factor login for everyone

• Two-factor authentication, which asks for a one-time code on top of your password, has disappeared from the security settings for all accounts.
• Once logged in, you can set a new password without typing the old one.
• Changing the email address no longer needs approval from the old address. The verification code goes to the new one, and the real owner is only told after the change is done.

The login itself looks odd too. No one-time code was requested, yet a Cloudflare check, a tool meant to keep bots out, appeared three times during sign-in. It is normally built into a single step.

Is the new Humble Bundle site "vibe-coded"?

Many users suspect so. "Vibe coding" means a site written largely by an AI such as Anthropic's Claude, with little human review. Several people say the new interface looks like what Claude produces. Nothing proves Humble used AI, and the company has not said anything about the redesign, so how it was built is unknown. Still, losing protections this standard suggests nobody checked security before launch.

It is not the only complaint. The library no longer separates games and keys you have already claimed from those still to activate, and the site does not keep you logged in between visits. In October, Epic Games launched an AI-assisted launcher that started faster than Steam's, according to the company, but lacked features.

What should you do on your Humble Bundle account?

Remove the saved bank card, at least until the flaws are fixed. Do not stay logged in on a shared computer, since being logged in is enough to change the password. And check the email address in your settings from time to time, because Humble no longer confirms with the old one before changing it.