Good catch, really. Trivial to fix fortunately. Not that I care too much about super secure secret searches, but if they're advertised as such they should be. And even then, you probably should assume they're not. (secret).
Exactly. Sure you could use Tor and disable everything and log on a random wifi from a stolen computer that will then be smashed to bits and melted, but that's beside the point; if DDG advertises privacy, it should do everything it can to deliver on that promise.
<?php
header("Location: the-result.com");
header("Referer: ");
So maybe you should have tested it ;) ?
But as for a fix, at least Opera offers the option of never sending referrer information. That would be enough in this case.