1/15/2026

Prevent CSV formula injection in QA exports

Why test-data exports need spreadsheet formula protection and how AddrID safely handles dangerous cell prefixes.

CSV is text, but spreadsheet applications may interpret cells beginning with an equals sign, plus, minus or at sign as formulas.

If test values contain user-controlled content, a direct export can trigger an unexpected formula when opened. A safer serializer prefixes those values with an apostrophe and correctly handles quotes, newlines and delimiters.

AddrID flattens nested fields before applying formula-prefix protection. CSV and TSV output are UTF-8 and include a byte-order mark for broad spreadsheet compatibility, while JSON and JSONL preserve their native structures.

Exports should still be treated as untrusted input. Automated test tooling should never execute commands or follow links merely because they appeared in a spreadsheet cell.