```json
[
  {
    "severity": "Critical",
    "issue": "Path Traversal (Directory Traversal)",
    "exploit": "An attacker can provide a path like '../../etc/passwd' or '../../home/user/.ssh/id_rsa' to escape the intended directory and read any file on the filesystem that the application process has permissions to access.",
    "fix": "Use os.path.abspath to resolve the full path and verify that it starts with the intended base directory. Example: \n\nfull = os.path.abspath(os.path.join('/srv/reports/', path))\nif not full.startswith('/srv/reports/'): \n    raise HTTPException(404)"
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack on Token Comparison",
    "exploit": "The standard '==' or '!=' operators for strings return as soon as a mismatch is found. An attacker can measure the time it takes for the server to respond to guess the token character by character.",
    "fix": "Use a constant-time comparison function such as 'secrets.compare_digest(token, os.environ['ADMIN_TOKEN'])'."
  }
]
```