Hacker News Reader

How is that a leak ? The URL is only sent to ddg server, encrypted using TLS so no eavesdropper can read it. It also stays in your browser history and let you use the back button.

Enable POST requests at https://duckduckgo.com/settings#privacy

That seems like a reasonable trade-off. It's https so it's not visible to people snooping on you, and it being GET means that browser history and sharing links to searches works.

Plus, they do have an option to go POST-only, so if you don't like their already-very-private default you can change it.

Just curious, but what threat model are you thinking of here?