Is it clear exactly what SafetyNet does and reports back to Google?

Is its source code available (including for any TrustZone component), maybe as part of AOSP?

I am OK with the concept and I can value it also as a protection against advanced malware, but only if it is totally transparent (to me!) what data it collects and relies upon.