Lockpick signs its security scan requests with Web Bot Auth. The public keys are at /.well-known/http-message-signatures-directory. What the requests are and how to allow them: https://lockpick.app/docs/protect/firewall