Bots on GOG keep locked gift/claim links posted unprotected in the platform's forum, likely by keeping a specific step of the claiming process open. Unprotected Steam keys get claimed near instantly in most Steam-related forums I've seen. Even saw allegedly legitimate group owners using bots to harvest such codes, while keeping their accounts private.
Dunno how popular Nebula actually is, as I use it very little, but I'd also advise obfuscating their codes, or even any gift codes.