Cavalary: And yeah, very worried about the account linking, where I assume they do store the credentials.
There's no need to assume anything - the linking of accounts is usually done based on a unique identifier. I find it extremely unlikely Humble Bundle will store any credentials except its own. It's more likely GOG has given them an API key based on which they can perform certain operations on GOG users (assuming they provide said unique identifier), such as add games to them.
For example, here's SmollestLight's user ID (and online presence as listed by the Galaxy API):
https://presence.gog.com/statuses?user_id=52857781047288620 Now if I were Humble and had a pre-esablished API integration with GOG and an agreement to add game X to that account, I'd be able to do that. No credentials required.
Jarik12.3: Haven't seen it posted here yet so, Humble Bundle is giving away free copies of SEVEN: Enhanced Edition for GOG.
Thanks for letting us know.