Upstream contribution · milind-soni/OpenMausBot
OpenMausBot · Protecting spreadsheet export semantics and encoded secrets
Problem
A conservative CSV formula guard also escaped valid signed numbers, turning negative amounts into spreadsheet text. The secret scrubber missed some form-encoded spellings of held passwords because browser form serialization escapes several characters that encodeURIComponent leaves intact.
Engineering response
The CSV serializer preserves plain signed numeric cells while escaping formula-like expressions. The login vault adds the spelling produced by URLSearchParams to its scrubber candidates, covering cases such as a held secret containing an exclamation mark represented as %21.
Evidence and scope
The linked regressions target the table CSV path and the login scrubber. The CSV test retains a formula control, and the masking PR includes an encoding example that distinguishes browser form serialization from URI component encoding.