Grails 3 installed a plugin somewhere (and ran it) after the plugin was listed in build.gradle. The plugin name is org.grails.plugins:spring-security-core:3.0.3.
It is a mystery to me where it was installed on disk. Some sources point me to .m2 maven repository but it does not seem to be there. Where should I look for it?
In your home (~) directory under .gradle/caches directory.
Full path: ~/.gradle/caches