`security://scans`: read-only scans/findings/reports.