A user visits http://example.com/login and sees their username and password appear in the browser's URL bar. Which HTTP method was incorrectly used?

Why D is correct

GET appends form data to the URL as query parameters, making credentials visible in the address bar, browser history, and server logs. Forms submitting sensitive data must use POST, which places data in the request body.