Couchbase maintains Spring Data Couchbase. Please report security issues to Couchbase, not to the Spring team.
Send the details of the issue by email to security@couchbase.com. The Couchbase security team will assess the report and contact you. Please do not open a public GitHub issue for a security problem.
For more information, see the Couchbase support page.
Spring Data JARs released on Maven Central are signed. You'll find more information about the key here: https://spring.io/GPG-KEY-spring.txt
Versions released prior to 2023 may be signed with a different key.