SecureJuniorSecurityAuto-graded
Stop a CSV export from injecting spreadsheet formulas
Exported data can attack whoever opens it, and junior candidates are judged on seeing that without mangling ordinary values.export.py is the CSV export behind a Download report button, and it writes every cell verbatim. The data in those cells comes from users — display names, notes, ticket subjects. Open the file in Excel, Sheets or LibreOffice and any cell starting with an active character is evaluated as a formula rather than shown as text. Neutralise that without mangling the legitimate data: the export still has to be valid CSV, and the original values must remain recoverable by whoever reads it.20 min
python
You're done when
- Cells crafted to execute as spreadsheet formulas are neutralised and no longer evaluate.
- The original value stays recoverable from the exported cell, rather than being destroyed.
- The same protection holds on a second, different dataset — the fix generalises rather than special-casing the sample.
What it measures
Application securityRecognising that an export is an injection surface, because the risk lands in a program you do not control.
Security gap analysisCovering the full set of active characters rather than the single one in the example, and confirming the fix on unfamiliar data.
Fixing without collateral damageNeutralising the dangerous case while keeping ordinary values intact and readable, which is what makes a security fix shippable.
Your environment
Terminal + editorA full shell in the browser
Claude CodePre-authenticated, no key setup
Isolated microVMYours alone, wiped afterwards
Start this lab
20 min
Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo