@orangeandblack5 funnily enough a new video in the saga dropped yesterday with a response. So, the “debunking” likely came from an AMA with one of the founders of Honey. In that, he asserted that a few key claims were not. He asserted that it wasn’t true that Honey allowed businesses to exclude coupons, and claimed they could only replace publicly available coupons with equal value to the highest value one. Here is a screenshot of one of Honey’s FAQ pages:
The requirement appears to be that they only needed a publicly available coupon at any rate to be allowed to exclude any other coupon codes arbitrarily (which is more or less the original allegation in the video). There was also metadata scraped for coupon codes on supported sites, and in the metadata there are notes that basically say a given code was excluded on brand request. There’s even a flag for websites in their data that will disable any code added by users (virtually all of them). And there’s even more evidence to support the original allegation that I’m not going to paraphrase.
The other claim was that Honey wasn’t switching their affiliate link at checkout. That’s verifiably false. The source code leaked, and its stand-down rules had an expiration time of 6 minutes (meaning they would only not swap the link out if checkout was completed in less than 6 minutes), but it has been increased to an hour recently (which is still dubious at best). There’s also a partially obfuscated file that describes testable behavior where the previously described stand-down rules are ignored (he tests it on the video to show that works as he hypothesizes) which means if you meet requirements like being logged-in and having an account age older than 30 days, it’ll just swap out the affiliate link and not stand-down as its obligated to do. The rules are also stored locally, so he could modify the file and show how it would selectively activate based on properties of his account. He also used the wayback machine to find earlier versions of these files to show that it used to be much more aggressive that ignoring stand-down obligations, and may have only recently sort of begun to comply because of lawsuits.
(Edit: This multiple file scheme with one being partially obfuscated is almost certainly designed to disguise this behavior from automated compliance testing because the values appear to be tuned to check for properties that would indicate an operator is extremely likely to be an actual human user.)