Worksheet hidden from the tab bar

How the text is hidden

xl/workbook.xml lists each worksheet as a <sheet> element carrying a state attribute and a relationship id pointing at the worksheet part. Setting state="hidden" removes the tab from the sheet bar; the worksheet part, its <sheetData> and every cell value stay in the package byte-for-byte unchanged. Excel's Unhide dialog lists the sheet, so a reviewer who thinks to look can bring it back.

Why a model still reads it

Extraction walks worksheet parts and cell values, not the tab bar. The state attribute lives in a different part from the text and changes nothing about how that text parses, so a model reads the hidden sheet's cells alongside the visible ones.

What we do about it

readSheetIndex reads state off each <sheet> element and carries it to every cell on that sheet; cellReason maps state="hidden" to the invisible reason container-hidden. The rule xlsx-hidden-sheet fires on that reason with a non-empty run, at severity high and action flag — the text is reported and left in the returned text, not removed. visibilityOf grades container-hidden as editing-only, because the unhide dialog is a route a reviewer has.

How often it fires

0.50% of 200 real workbooks from five national open-data portals (CA, IE, DE, GR, UK), measured 2026-08-21.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.