Practical guidance
Review formula risks before opening a CSV in a spreadsheet
A CSV contains text, but a spreadsheet can interpret some text as a formula. Treat files from suppliers, exports, and other people as data that needs inspection.
A finding is not permission to change product data
A value beginning with a formula trigger deserves review before opening it in a spreadsheet. It may be malicious, or it may be a legitimate product code. A warning should show the original string and let you decide what the field is intended to contain.
SKU,Title
=1+1,Example supplied codeChoose the right download
The machine-import file preserves product values. The human-readable reports neutralize formula-like cells for spreadsheet viewing. These are different purposes: feeding the report back into a marketplace can introduce safety prefixes into identifiers or descriptions.
- Inspect formula findings in the browser first.
- Use the change report for reviewing edits in a spreadsheet.
- Use the corrected import file only for the intended marketplace import.
- Do not remove spreadsheet warnings or enable external content from an unfamiliar file.
Escaping is application-specific
OWASP documents that spreadsheet handling differs and that some protections can change after a save and reopen. No report format should be described as universally safe in every spreadsheet. Keep the report’s purpose visible and avoid active spreadsheet features.
What this check cannot establish
Golanto flags formula-like strings; it does not prove a file is harmless. Machine exports preserve source data and should not be treated as spreadsheet-safe reports.
Check your file
Start with a copy. Review changes before downloading your import file.
Open the CSV tool