```json
[
  {
    "severity": "High",
    "issue": "Path Traversal",
    "exploit": "An attacker can provide a path like '../../etc/passwd' to escape the '/srv/reports/' directory and read arbitrary files on the server.",
    "fix": "Use os.path.basename(path) to ignore directory components or validate that the absolute path starts with the intended base directory."
  },
  {
    "severity": "Low",
    "issue": "Timing Attack",
    "exploit": "The standard string comparison (!=) returns as soon as a character mismatch is found, allowing an attacker to potentially brute-force the ADMIN_TOKEN by measuring response times.",
    "fix": "Use secrets.compare_digest() for constant-time string comparison."
  }
]
```