Key takeaway
Do not treat CSV as safe just because it has no macros: a spreadsheet may interpret leading special characters as formulas. Encode exports safely and inspect files from outside.
Prevent user values from being treated as formulas
CSV (Comma-Separated Values) is plain text arranged as rows and delimited fields; the application opening it determines how values are interpreted. User values beginning with =, +, - or @ may become formulas. Encode each exported cell correctly and neutralize values that could be treated as formulas. Checking only the first input character is insufficient because delimiters and quotes may create another cell. Include tabs and line breaks in tests. Test in the actual Excel, LibreOffice or Sheets version, including saving and reopening the file. Quotes or a single prefix are not a universal guarantee; also check effects on downstream machine imports.
Treat an external CSV as untrusted input
Before loading an external CSV into a business system, verify the sender, columns, encoding, delimiter and row count. Start with a text viewer that does not evaluate formulas; do not open a suspicious file in a normal spreadsheet session. Import software must validate field types, lengths and permitted values. Check a sample for preserved leading zeros in identifiers, dates and decimal separators. Test before bulk import and prepare a way to undo incorrect changes. A file extension does not establish trust.
Limit access to sensitive exports and how long they are kept
A CSV stores data as plain text and can make customer, employee and operational data easy to share. Export only needed columns, use an approved storage channel, restrict access to intended recipients and set a deletion date for the copy. Check the organization’s data-sharing rules before attaching it to email or personal cloud storage. Keep backup and change control for the source database separate; a CSV does not provide versioning or recovery by itself.