Font colour matching the cell fill
A cell whose font colour matches the fill behind it reads as an empty cell on screen and as its full contents to a parser.
How the text is hidden
Two attributes set independently: the font colour in <font><color/></font> and the cell's fill in <fill><patternFill><fgColor/></patternFill></fill>, both in xl/styles.xml, both reached through the cell's s index into cellXfs. Setting them to the same value — Fill Color then Font Color, two clicks in Excel's ribbon — leaves the glyphs painted and unreadable. White on the sheet's default white ground is the same trick with no fill declared at all.
Why a model still reads it
Colour is a style-sheet property stored in a different part from the text. Cell readers resolve the value or the shared-string index and never consult the font or fill, so the text arrives with nothing marking it as unreadable.
What we do about it
readStyles resolves a font colour from an ARGB rgb attribute or from a <color theme="N" tint="T"/> index against the workbook's theme part — the first xl/theme/themeN.xml in the package, where one is present — falling back independently to the named style in cellStyleXfs when the cell's own format supplies none.
How often it fires
0% of 200 real workbooks from five national open-data portals (CA, IE, DE, GR, UK), measured 2026-08-21.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A red team put a false exchange rate into an Excel pricing sheet three ways — hidden cells and a fake sheet, then white font, then three lines in a cell styled like its neighbours with the row left at its default height so only the first line showed — and the last one got past a model that had caught the white font.
An Office document carried hidden white-text instructions on a second sheet, and Microsoft 365 Copilot followed them: it fetched the user’s recent emails, hex-encoded them, and hid the result in a Mermaid diagram rendered as a fake login button that sent the data onwards when clicked.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API