Would you take a pull-request security scan workflow?

Would a pull-request security scan be useful here, or is this already covered?

One workflow. On each pull request it scans the checked-out repository for
hardcoded credentials, injection, SSRF and unsafe deserialisation, and writes
findings to the Security tab. Report-only — findings never fail the build.

Two files under `.github/`, a pinned `@profullstack/threatcrush@0.11.0` whose tarball is hashed before
install, and `pull_request` rather than `pull_request_target`.

A pull request is open alongside this with the diff, if reading it is easier
than discussing it.

Disclosure: I maintain [ThreatCrush](https://github.com/profullstack/threatcrush);
MIT and free. Written with AI assistance. Closing this is a fine answer and I
will not ask again.

Start by reading the existing workflows under `.github/` and the open pull request diff. Check whether the proposed report-only scan, pinned and hashed ThreatCrush action, and `pull_request` trigger fit the repository’s current CI and security setup; done means a maintainer-approved workflow with the stated scope and no build failure from findings.

Written by the indexing model from the issue text.