```json
[
  {
    "severity": "Critical",
    "issue": "Path Traversal",
    "exploit": "An attacker can provide a path like '../../etc/passwd' or '../../root/.ssh/id_rsa' to read any file on the filesystem that the application process has permissions to access.",
    "fix": "Use pathlib.Path to resolve the absolute path and verify that the resulting path starts with the intended base directory (e.g., using .resolve() and .is_relative_to())."
  },
  {
    "severity": "Low",
    "issue": "Timing Attack",
    "exploit": "The use of the '!=' operator for token comparison allows an attacker to potentially brute-force the ADMIN_TOKEN character-by-character by measuring the time it takes for the server to return a 403 error.",
    "fix": "Use secrets.compare_digest(token, os.environ[\"ADMIN_TOKEN\"]) to perform a constant-time string comparison."
  }
]
```