Spreadsheet exports need formula-injection controls at the data boundary

A CSV file becomes an active document when opened in a spreadsheet, where cells starting with characters like =, +, -, or @ can be read as formulas. Values drawn from user input or external feeds can therefore execute in the recipient's spreadsheet context, even though the file itself is plain text. Quoting values as CSV does not reliably prevent this, so controls must account for the spreadsheet program rather than only the file grammar. The article recommends inventorying exports, neutralizing dangerous values in one shared export library, and applying the same authorization, rate limits, and audit logging used elsewhere. Testing should use non-production spreadsheet profiles with links and macros disabled, and any visible-data changes should be documented.