Enable private vulnerability reporting.

Closes #2146

Author: mp911de

SECURITY.adoc

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please [open a draft security advisory](https://github.com/spring-projects/spring-data-couchbase/security/advisories/new) if you need to disclose and discuss a security issue in private with the Spring Data team.
+Note that we only accept reports against [supported versions](https://spring.io/projects/spring-data#support).
+
+For more details, check out our [security policy](https://spring.io/security-policy).
+
+## JAR signing
+
+Spring Data JARs released on Maven Central are signed.
+You'll find more information about the key here: https://spring.io/GPG-KEY-spring.txt
+
+Versions released prior to 2023 may be signed with a different key.

SECURITY.md

@@ -0,0 +1,11 @@
+= Getting support for Spring Data Couchbase
+
+Spring Data Couchbase is a community-maintained Spring Data project by https://www.couchbase.com/[Couchbase]. It is released as part of the Spring Data Release train.
+
+== GitHub issues
+
+We choose not to use GitHub issues for general usage questions and support, preferring to use issues solely for the tracking of bugs and enhancements.
+If you have a general usage question, please do not open a GitHub issue but use one of the other channels https://github.com/spring-projects/spring-data-couchbase#getting-help[described in the readme file].
+
+If you are reporting a bug, please help to speed up problem diagnosis by providing as much information as possible.
+Ideally, that would include a small sample project that reproduces the problem.