[neurostimulant]

AFAIK if you type something in the browser's omnibar, the search provider such as google will receive the autocomplete query, so google will at least know your secret domain. If you're using letsencrypt, your subdomain will show up in the public CT log, which is probably being mined by some data or security companies. Your dns providers will also know this secret subdomain as well and and some data companies might be able to obtain them.

[chrismorgan]

Firefox seems to be moderately conservative about what it does search autocompletion on. Type in the full URL, protocol and all, and it doesn’t look like it leaks anything after the colon.

As for CT logs, this leak is avoided by using a wildcard certificate, which Let’s Encrypt supports.