[CaptainOfCoit]

> First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons.

Judging by what a person from the Immich team said, that does not seem to be true?

> the whole system only works for PRs from internal branches - https://news.ycombinator.com/item?id=45681230

So unless one of the developers in the team published something malicious through that system, it seems Google did not have a legitimate reason for flagging it.

[bo0tzz]

> unless one of the developers in the team published something malicious through that system

If that happened we'd have much bigger problems than Google's flagging.

[lucideer]

Anyone can open a PR. Deploys are triggered by an Immich collaborator labelling the PR, but it doesn't require them to review or approve the code being deployed.

[bo0tzz]

As I've mentioned in several other comments in this thread by now: The whole preview functionality only works for internal PRs, untrusted ones would never even make it to deployment.

[krzyk]

Yes, but unless that pr contain malicious code domain shouldn't be marked as such. You should assume good faith, not the other way around.