Legacy workbook styles out of scope
A scope disclosure, not a concealment technique: it says out loud that a legacy binary .xls has its text read and its styling and sheet visibility not read.
How the text is hidden
A binary .xls is BIFF8 — a compound file whose Workbook stream is a flat sequence of records. Almost every string lives once in the Shared String Table and is referenced by index, and that table routinely spills across CONTINUE record boundaries with a single string split in half and its own width flag on the continuation. This parser reads text: shared strings, inline LABEL and RSTRING strings, and the text of legacy text boxes (TXO, whose characters arrive in the CONTINUE records that follow it). It does not read formulas, number formats, colours, or the BOUNDSHEET records that say a sheet is hidden.
Why a model still reads it
The text of a hidden .xls sheet is extracted in full — what is absent is the report that it was hidden. That asymmetry is precisely why an empty findings list on a legacy workbook must not be read as a clean result.
What we do about it
There is no detector here. xlsScopeFindings emits one finding in family disclosure at informational with action: 'disclosed' on every legacy workbook that yielded any string, with count: 1, chars: 0 and no excerpt location beyond Workbook — nothing was read to count, and a number would be invented. It is deliberately a disclosure rather than a coverage gap: as a gap it drove every workbook out of a real verdict, whereas as a disclosure it withholds the certificate and leaves the verdict alone. It is silent when the workbook yielded nothing, because an unreadable or encrypted workbook already carries a stronger gap saying so.
How often it fires
Not measured. We publish a rate only where one has been measured against a named corpus of the right format, and no figure exists for this technique yet. Absence means unknown — never low.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API