If there is leak I'm of course happy to fix it. Ahh, this is a bug I just committed yesterday fixing something else for someone. Will fix right away -- the html version is supposed to be using POST by default.
Edit: fixed. The non-JS versions are somewhat new and there are a lot more bugs floating around them. Please report whenever you see something awry.
I don't understand this at all because for the non-JS version you should never be on https. If you go the http homepage, the default form submit is POST and HTTPS. JS changes the action, so if you have JS off it should submit to the non-JS vesion (via HTTPS and POST). Also, the non-JS plugins are also HTTPS. Please email me to sort out what is going on: http://duckduckgo.com/feedback.html
