Safari’s Private Browsing Mode Saves URLs in an Easily Accessible File
If you are using Safari on your Mac for personal browsing, you might want to stop. MacIssues specifies that all URLs you visit privately are still stored in a database file that anyone on your computer can view.
Safari saves all icon images and URLs you visit in ~/Library/Safari/WebpageIcons.db . You can open this file in any SQLite browser . Once you’ve done that, you’ll find a complete list of all the URLs you’ve ever visited in Safari, private mode or otherwise, in the PageURL table. Obviously it takes a little work to get to this file so no one will accidentally see it, but if you’re worried about someone sneaking up on your personal computer, it’s probably best not to use Safari for personal browsing. For now, you can simply delete the Webpageicon.db file to get rid of this whole story.
Safari bug keeps web page URLs private | MacIssues