Currently, Security for Confluence scans:
-
Pages
-
Blog posts
-
Attachments
-
See Scanning Files Attached to Pages for more information on supported file types
-
-
Comments, including top-level comments on pages and blog posts, inline comments on pages and blog posts, and comments on attachments
Note that drafts are not yet scanned.