For now I suggest to use the tool in a scheduled, serverless manner and configure evaluation output to Security Command Center. By that, processes will be fully automated and the results will be visible in a webconsole (as findings in Security Command Center).

How does this work? It's developed by google but it's not officially supported?

My memory of Google US employment legalese - note I have not worked for them for over 7 years and am not speaking for them here - is that they acknowledge limits to their IP assignment provisions which are consistent with California law. Any Googler who is confident that those limits protect their ownership by default of their side project does not have to seek Google's approval in order to own it, even according to the contract wording.

But Google's business is so broad that it's often legitimately debatable (and sometimes beyond the knowledge of the Googler doing the work) as to whether something would be in scope. So getting their approval, which can come either with explicit assignment of rights back to the Googler or explicit permission to release under Google copyright, is often the prudent approach to minimize undesired risks.

Google actually publishes most of the docs that Googler's have to follow when open sourcing software. See:

https://opensource.google/documentation/reference/releasing

This specific line you're asking about is talked about here: https://opensource.google/documentation/reference/releasing/...