diff --git a/cli/securelens/scanners/__init__.py b/cli/securelens/scanners/__init__.py
index 992497d..a3c22c9 100644
--- a/cli/securelens/scanners/__init__.py
+++ b/cli/securelens/scanners/__init__.py
@@ -150,6 +150,12 @@ def discover_files(root: Path, cfg: CLIConfig) -> list[Path]:
                 continue
             candidates.append(p)
 
+            # Capping safeguard: limit to 1000 candidate files
+            if len(candidates) >= 1000:
+                break
+        if len(candidates) >= 1000:
+            break
+
     return sorted(candidates)