Terms, plainly.
What the check does, what the verdict is, what is kept.
What the check does
One passive GET to the root of the address you give. It reads response headers and HTML signatures. It sends no payload and tests no exploit. The advanced report sends up to four more GETs of the same kind.
What the verdict is
A reading of what the server shows the outside world, compared with the public patched table. It is a triage aid, not an audit, and it promises nothing. UNKNOWN and ERROR are never shown as safe.
What we keep
The address you checked, the headers read and the verdict, on the report link. Public statistics are aggregates. No list of vulnerable domains is published or sold.
The token
$COOKED unlocks features for holders. It is not an investment and nothing here is financial advice.