```json
[
  {
    "severity": "Critical",
    "issue": "Path Traversal",
    "exploit": "An attacker can provide a path containing directory traversal sequences (e.g., '../../etc/passwd') to escape the intended directory and access sensitive files on the server.",
    "fix": "Use os.path.abspath() or pathlib.Path.resolve() to get the absolute path of the requested file and verify that it starts with the intended base directory path."
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack on Token Comparison",
    "exploit": "The standard '!=' operator performs a short-circuiting string comparison. An attacker can measure the time taken for the server to respond to guess the token character by character.",
    "fix": "Use secrets.compare_digest() to perform a constant-time comparison between the provided token and the environment variable."
  }
]
```