Security tooling · 2026 · Solo — research, product design, build, verification
Cell Sentry
An interactive CSV formula-risk inspector for reviewing user-controlled exports before they reach a spreadsheet.
The problem
CSV files can carry user-controlled values into spreadsheet applications that interpret formula initiators. OWASP notes that checking raw input is insufficient because delimiters and quotes define the actual cell boundary, and it warns that no universal sanitization strategy works across all spreadsheet applications and downstream consumers. Cell Sentry makes the bounded review step visible without claiming universal safety.
Architecture
Key decisions
Inspect parsed cells, not raw substrings
Quoted commas and escaped quotes can move values across apparent boundaries. A bounded parser makes each finding traceable to the cell a spreadsheet reader would receive.
Call it a review copy, not a safe file
The product prefixes bounded findings and quotes every field, while keeping OWASP's portability warning visible beside the output. It does not promise one transformation works for every spreadsheet or downstream consumer.
Command / Inspect, not dashboard
The asymmetric source-and-ledger composition makes one input and its exact cell evidence dominant—no marketing hero, fake chart, feature-card grid, or invented usage metric.
Verify language and behavior in production
Static and rendered English-script checks, keyboard and focus assertions, two responsive viewports, zero-console-error checks, and a production HTTPS golden path all passed before portfolio integration.