By default, WPRemote scans only WordPress files. However, you can also add non-WordPress files and then run a scan.