This morning my manager got notified by a security alert regarding Confluence.
Still, I didn't get the same email even if I am also listed as technical contact for our licenses.
For this reason I can assume that only the main contact gets the notification regarding security alerts, that's very wrong.
Note: I tried to search (google) for a place where someone can subscribe/unsubscribe from security alters from atlassian but I wasn't able to find one.