You may be referring to URLs being stored in unencrypted media such as logs. Yes never put sensitive data in a URL. But as others said, HTTPS encrypts everythin

You may be referring to URLs being stored in unencrypted media such as logs. Yes never put sensitive data in a URL. But as others said, HTTPS encrypts everything going over it (except the host name in sni)