> First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons.

Judging by what a person from the Immich team said, that does not seem to be true?

> the whole system only works for PRs from internal branches - https://news.ycombinator.com/item?id=45681230

So unless one of the developers in the team published something malicious through that system, it seems Google did not have a legitimate reason for flagging it.