excel-safe-csv's main security property is that untrusted values can never become live spreadsheet formulas ("CSV injection" or "formula injection", see OWASP) unless you explicitly opt out with formulas: 'allow' or type: 'raw'.

A value that, written with the default options, is evaluated as a formula by Microsoft Excel, Google Sheets or LibreOffice Calc is a security bug. So is a value that makes the parser hang.

Please report vulnerabilities privately through GitHub security advisories rather than in a public issue. Include the value(s), the options used and the spreadsheet application and version. You will receive a response within a few days.

Security fixes are released for the latest major version.