Browser-based frontends need CORS to call the API. Apply tower_http::cors::CorsLayer::permissive() at the router level so the frontend (and other origins during development) can reach the scan endpoint.
The second loop is unreachable: the first loop returns as soon as it finds an existing candidate. Collapse to a single iterator chain.
LORDBABUINO