Is it clear exactly what SafetyNet does and reports back to Google? Is its source code available (including for any TrustZone component), maybe as part of AOSP

Is it clear exactly what SafetyNet does and reports back to Google? Is its source code available (including for any TrustZone component), maybe as part of AOSP? I am OK with the concept and I can value it also as a protection against advanced malware, but only if it is totally transparent (to me!) what data it collects and relies upon.