What happens to a comma inside a value?

The field is quoted, and any quote inside it is doubled, which is what RFC 4180 specifies. Skipping this is how an export silently gains a column the first time somebody's name has a comma in it, and the damage is not obvious until much later.

What if the rows have different keys?

Every key from every row becomes a column, in the order they were first seen, and a row missing one gets an empty field. Taking the columns from the first row alone is the common shortcut and it silently drops any field that only appears further down.

What about nested objects?

A nested value is written as JSON inside the cell rather than being flattened into extra columns. Flattening needs a naming convention that would be a guess, and a cell you can parse back is more useful than one that has been rearranged.

JSON to CSV

CSV that survives commas in the data.

JSON

Separator

CommaSemicolonTab

CSV that survives commas in the data.

How to use it

Paste an array of objects. Each object becomes a row and each key becomes a column.
Pick the separator. Semicolons if your spreadsheet is set to a European locale.
Download the CSV. Quoting is handled, so commas inside values do not split a row.

When you would use this

Converting JSON to CSV is two loops and a lot of edge cases, and the edge cases are where exports quietly corrupt themselves. Quoting is the first. A field containing a comma has to be wrapped in quotes, and a quote inside it has to be doubled. This is RFC 4180 and it is not optional: without it, the first customer whose name is written as a surname and a given name pushes every subsequent column one to the right, in that row only, and nobody notices until a report is wrong three weeks later. Columns are the second. Real data is rarely uniform, and taking the header from the first row means any field that only appears later disappears without a word. Every key from every row becomes a column here, in the order they were first seen. Nested objects are written as JSON inside the cell. Flattening them into extra columns would need a naming convention, and any convention here would be a guess. The file is built in your browser and downloaded from there, so an export with real records in it is never uploaded anywhere.

Questions

What happens to a comma inside a value?: The field is quoted, and any quote inside it is doubled, which is what RFC 4180 specifies. Skipping this is how an export silently gains a column the first time somebody's name has a comma in it, and the damage is not obvious until much later.
What if the rows have different keys?: Every key from every row becomes a column, in the order they were first seen, and a row missing one gets an empty field. Taking the columns from the first row alone is the common shortcut and it silently drops any field that only appears further down.
What about nested objects?: A nested value is written as JSON inside the cell rather than being flattened into extra columns. Flattening needs a naming convention that would be a guess, and a cell you can parse back is more useful than one that has been rearranged.