- ConfluenceSource searches exposed instances via /rest/api/content/search CQL - GoogleDocsSource uses dorking + /export?format=txt for plain-text scanning - HTML tag stripping for Confluence storage format - Both credentialless, tests with httptest mocks confirm findings