Your config never leaves this page. Parsing and grading run in JavaScript already in your browser. Nothing is uploaded, stored or logged. Check it: open devtools, Network tab, run an audit. No request is made.
The page does load a web font and an analytics script, which record the visit and never the box. Your config stays in this tab's memory until you close it or press Clear.
Your config is parsed and graded against the settings that quietly break a tunnel: dead ciphers, compression oracles, unauthenticated control channels, DNS that never enters the tunnel.
Its evidence is the file you paste. It cannot see your server's side, your firewall, your OS resolver, your client app's own kill switch, or files the config only names (ca.crt, ipsec.secrets, an auth-user-pass file). A clean report means no known-bad setting from these checks. Unrecognised directives are listed rather than dropped, and every finding names its line.
Deliberately bad configs, so you can see what a finding looks like. Fabricated, with placeholder keys, not real credentials.