We use a local repo as well(its easy to setup) and so this type of security is not something we even think about. If we are adding/version changing dependencie

We use a local repo as well(its easy to setup) and so this type of security is not something we even think about. If we are adding/version changing dependencies we just have to put a little more work into making sure the jar that goes to our local repo is good, but that doesn't happen every day. Of course when prototyping or just playing around this could become an issue...