security scan activates on:

- cron schedule
- `main` branch pushes & pull requests

.github/workflows/security.yml

@@ -1,6 +1,12 @@
 name: Security
 
-on: push
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+  schedule:
+    - cron: '25 16 * * 4'
 
 jobs:
   security: