The restoration engine now strictly validates the contents of a .backup file before processing it. It prevents path traversal attempts, ensuring that a backup file cannot overwrite system binaries or inject files into unauthorized directories. 3. Separation of Sensitive Data (Export vs. Backup)