You're referring to a bug from June of 2020, which was patched within a couple days of discovery, IIRC. An issue which had no privacy or security impact. Details in our blog on the subject: https://brave.com/referral-codes-in-suggested-sites/. Happy to answer any questions you may have.