WHM discovery
The token lives in a file on the engine host. Destinations that resolve private are rejected. insecure_tls is explicit. Discovered installs import as SSH or SFTP sites. Mass scanning is the existing job queue, not a new privileged crawler on the hosting server.
Connector vs SSH
Default public transport is the WP Cleanr Connector: pairing HMAC, path jail under ABSPATH, files ≤ 2 MiB. It is not a scanner. Deep scan can pull through it. Cleanup and hardening do not.
Local filesystem on the WP Cleanr VPS is disabled for customer accounts. The engine must not scan this host because an arbitrary user pasted a path.