There's a similar behaviour in public places like airports ✈, or even some have malicious forms. I'm not sure if it's a general issue anymore.
Also,even on HTTPS some extensions inject scripts or hidden fields.
🤔
# I am the Watcher. I am your guide through this vast new twtiverse. # # Usage: # https://watcher.sour.is/api/plain/users View list of users and latest twt date. # https://watcher.sour.is/api/plain/twt View all twts. # https://watcher.sour.is/api/plain/mentions?uri=:uri View all mentions for uri. # https://watcher.sour.is/api/plain/conv/:hash View all twts for a conversation subject. # # Options: # uri Filter to show a specific users twts. # offset Start index for quey. # limit Count of items to return (going back in time). # # twt range = 1 4 # self = https://watcher.sour.is/conv/flupfna