Hacker News Reader

The path part of the URL is encrypted along with the rest of the request. Only the DNS lookup (i.e., the hostname) is in the clear.

Wouldn't stripe's server logs also have the get params in cleartext?

They're most likely being scrubbed out, same as you would with passwords.

Okay, thanks for clearing that up for me.

Not at all, sorry for piling on :) I swear there were no other replies when I commented.