# Check explicit restic source paths against exclusion expectations

> Review executed restic source arguments alongside filters before accepting backup scope.

- Canonical URL: https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:08+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Review executed restic source arguments alongside filters before accepting backup scope.

## Potentially affected

This applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.

## DSE recommendation

DSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists.

## Article

Review executed restic source arguments alongside filters before accepting backup scope.

## Source facts

Restic’s backup guide states that exclusions do not override source paths explicitly passed to the backup command. The exact named file is backed up even if an exclusion would otherwise match it; directory contents are still filtered. The guide also describes cache-tag and marker-file exclusions, with different handling of the tag itself. Consequently, reviewing an exclusion file alone is insufficient to determine backup scope when a wrapper script also supplies explicit source arguments.

Source: [restic — Backing Up](https://restic.readthedocs.io/en/stable/040_backup.html).

## Applicability

This applies to the stable restic backup command documented here. It addresses the interaction between explicit roots and exclusion rules, not a guarantee that every excluded item is absent from historical snapshots.

## DSE recommendation

DSE recommends reviewing the final executed argument list alongside exclusion files and application-generated source lists. Use harmless test markers that represent sensitive or intentionally omitted paths before approving scope. Record whether a marker excludes a directory’s contents and whether the marker itself should remain. Keep historical cleanup requests separate from future backup filtering. Avoid assuming that adding a path to an exclusion list changes an older archive or overrides a script that explicitly names that file.

## Verification

Build a disposable directory tree and compare a file named directly on the command line with the same file reached through a parent directory. Inspect each snapshot’s actual file listing. Retain the executed arguments and expected inclusion matrix, and investigate any difference before using real sensitive data.

## Official reference

[restic — Backing Up](https://restic.readthedocs.io/en/stable/040_backup.html). Reviewed October 15, 2026.

## Primary reference

- Name: restic — Backing Up
- Authority: restic.readthedocs.io
- URL: https://restic.readthedocs.io/en/stable/040_backup.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check explicit restic source paths against exclusion expectations,” DSE Security, https://update.dsesecurity.com/updates/check-explicit-restic-source-paths-against-exclusion-expectations/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.