Paths excluded in a backup profile are now applied on installations whose root is reached through a symlink — the release layout of Deployer, Capistrano and most zero-downtime deployments. There every exclusion was ignored, and the archive held the files the profile had taken out, including auth.json, while the run reported success. Failures that used to pass unnoticed are now reported: an old backup folder that could not be removed during rotation, a directory the profile tree could not read, a table list that could not be loaded, and a cloud credential that could not be decrypted — that last one was handed to the storage provider still encrypted, which looked like the provider refusing the connection.