The spreadsheet export that emailed your database to an attacker

Picture the least dangerous ticket in your backlog: "Add an Export to CSV button." You wire up a loop, write a header row, dump each record, and ship it. No parsing, no eval, no network — just text go