- Block system-critical paths (/etc, /usr, /bin, /sbin, /boot, /dev, /proc, /sys, /) - Resolve path before validation to defeat symlink tricks - Exit with error message if blocked path detected