The passive scan uses only GET requests. The CORS check makes one credentialed GET request. Neither sends forms, performs credential attempts, creates load, nor logs response bodies or credentials.