CSV is data until a spreadsheet treats it as code.

The difficult example: four formula-like prefixes

These values may be legitimate product names, commands, handles, or negative numbers. Automatically prefixing them with an apostrophe changes the source data, so the converter keeps them verbatim and puts the review decision in front of the person opening the file.

[
  {"value":"=1+1"},
  {"value":"+cmd"},
  {"value":"-2"},
  {"value":"@channel"},
  {"value":"=HYPERLINK(\"http://x\")"}
]

value
=1+1
+cmd
-2
@channel
"=HYPERLINK(""http://x"")"

Safety warning: review untrusted CSV before opening it in a spreadsheet. RFC 4180 quoting protects CSV syntax; it is not a universal spreadsheet execution policy.

A safer conversion contract

• Preserve: the value stays byte-for-byte recognizable to downstream systems.
• Warn: preview identifies formula-like values before the attachment is downloaded.
• Decide: if your organization needs a transformed “safe export,” define and test that policy separately from the canonical data export.