# CSV Exports & Formula Injection Security

**Document Version:** 2.0.0 (Phase 17)

---

## 1. Supported Report Types

- `/analytics/export?type=leads`
- `/analytics/export?type=sources`
- `/analytics/export?type=pipeline`
- `/analytics/export?type=team`

---

## 2. Formula Injection Protection (CSV Injection Defense)

To prevent Remote Code Execution (RCE) or malicious formula interpretation in spreadsheet applications (Microsoft Excel, LibreOffice, Apple Numbers, Google Sheets):
- Any cell value beginning with `=`, `+`, `-`, `@`, `\t`, or `\r` is automatically escaped with a leading single quote (`'`).
- Prevents spreadsheet formula execution (e.g. `=cmd|'/C calc'!A0` or `@SUM()`).