{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/check-explicit-restic-source-paths-against-exclusion-expectations/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
        "slug": "check-explicit-restic-source-paths-against-exclusion-expectations",
        "url": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/check-explicit-restic-source-paths-against-exclusion-expectations/"
        },
        "title": "Check explicit restic source paths against exclusion expectations",
        "summary": "Review executed restic source arguments alongside filters before accepting backup scope.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:08+00:00",
        "modified_at": "2026-10-15T13:36:16+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 256,
        "potentially_affected": "This applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.",
        "dse_recommendation": "DSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists.",
        "primary_source": {
            "name": "restic — Backing Up",
            "url": "https://restic.readthedocs.io/en/stable/040_backup.html",
            "published_on": null,
            "authority": "restic.readthedocs.io"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Review executed restic source arguments alongside filters before accepting backup scope.</p>\n<h2>Source facts</h2>\n<p>Restic&#8217;s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.</p>\n<p>Source: <a href=\"https://restic.readthedocs.io/en/stable/040_backup.html\">restic — Backing Up</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory&#8217;s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.</p>\n<h2>Verification</h2>\n<p>Build a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot&#8217;s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://restic.readthedocs.io/en/stable/040_backup.html\">restic — Backing Up</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Review executed restic source arguments alongside filters before accepting backup scope.\nSource facts\nRestic’s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.\nSource: restic — Backing Up.\nApplicability\nThis applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.\nDSE recommendation\nDSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory’s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.\nVerification\nBuild a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot’s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.\nOfficial reference\nrestic — Backing Up. Reviewed October 15, 2026.",
        "content_markdown": "Review executed restic source arguments alongside filters before accepting backup scope.\n\n## Source facts\n\nRestic’s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.\n\nSource: [restic — Backing Up](https://restic.readthedocs.io/en/stable/040_backup.html).\n\n## Applicability\n\nThis applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.\n\n## DSE recommendation\n\nDSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory’s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.\n\n## Verification\n\nBuild a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot’s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.\n\n## Official reference\n\n[restic — Backing Up](https://restic.readthedocs.io/en/stable/040_backup.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
                "url": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check explicit restic source paths against exclusion expectations",
                        "item": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/#article",
                "identifier": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
                "url": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/",
                "headline": "Check explicit restic source paths against exclusion expectations",
                "description": "Review executed restic source arguments alongside filters before accepting backup scope.",
                "abstract": "Review executed restic source arguments alongside filters before accepting backup scope.",
                "articleBody": "Review executed restic source arguments alongside filters before accepting backup scope.\nSource facts\nRestic’s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.\nSource: restic — Backing Up.\nApplicability\nThis applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.\nDSE recommendation\nDSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory’s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.\nVerification\nBuild a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot’s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.\nOfficial reference\nrestic — Backing Up. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:08+00:00",
                "dateModified": "2026-10-15T13:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check explicit restic source paths against exclusion expectations"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 256,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "restic — Backing Up",
                    "url": "https://restic.readthedocs.io/en/stable/040_backup.html"
                }
            }
        ]
    }
}