Please, open a draft security advisory if you need to disclose and discuss a security issue in private with the H2 team. Note that we only accept reports against latest released version.

H2 and MVStore JARs released on Maven Central are signed. You'll find more information about the key here: https://h2database.com/html/GPG-KEY-h2.txt