# Security

EPPlus Software is committed to transparency and responsible handling of security vulnerabilities. Our security practices, policies and reports are published in the [security section](<https://epplussoftware.com/en/Security>) of our website. This page gives an overview and links to the parts of this documentation that cover security-related features.

### Reporting a vulnerability

Read our [Vulnerability Disclosure Policy](<https://epplussoftware.com/en/Security/VulnerabilityDisclosurePolicy>) before reporting a vulnerability. It describes how to report, what to expect from us and how we handle reports, and is established in accordance with the EU Cyber Resilience Act. The EPPlus repository on GitHub also has a [security policy](<https://github.com/EPPlusSoftware/EPPlus/security/policy>).

### Security at EPPlus Software

- [Vulnerability Disclosures](<https://epplussoftware.com/en/Security/Vulnerabilities>) - Publicly disclosed vulnerabilities in EPPlus and its dependencies, each with our assessment and recommended actions.
- [Scan Results](<https://epplussoftware.com/en/Security/Scanresults>) - Results of the regular vulnerability scanning of EPPlus and its dependencies, for each supported version.
- [Security Profile](<https://epplussoftware.com/en/Security/SecurityProfile>) - What EPPlus is, how it runs and what it is responsible for, with guidance for customer security assessments.
- [Supported Versions](<https://epplussoftware.com/en/Security/SupportedVersions>) - The support lifecycle for each major version, including the security support period.
- [Code Signing](<https://epplussoftware.com/en/Security/CodeSigning>) - All EPPlus assemblies and the NuGet package are digitally signed.
- [Software Bill of Materials](<https://epplussoftware.com/en/Security/Sbom>) - An SBOM in CycloneDX JSON format for every release.

The source code is also continuously analyzed with GitHub CodeQL on every push to our main branches.

### Security in your application

- [Security considerations when calculating formulas](<https://epplussoftware.com/docs/formulas-and-filters/formula-calculation/security-considerations-when-calculating-formulas/index.md>) - What to consider when calculating formulas in workbooks from untrusted sources.
- [Encrypt and Protect your workbook](<https://epplussoftware.com/docs/vba-and-protection/encrypt-and-protect-your-workbook/index.md>) - Workbook and worksheet protection, and encrypted packages.
- [Digital Signatures](<https://epplussoftware.com/docs/vba-and-protection/digital-signatures/index.md>) - Sign workbooks with a certificate.
- [VBA](<https://epplussoftware.com/docs/vba-and-protection/vba/#sign-your-vba-code>) - Sign VBA code.
- [Working with Sensibility Labels](<https://epplussoftware.com/docs/vba-and-protection/working-with-sensibility-labels/index.md>) - Sensitivity labels with the Microsoft Information Protection SDK.

### See also

- [Releases/versioning](<https://epplussoftware.com/docs/versions/releases-versioning/index.md>)