```json
[
  {
    "severity": "Critical",
    "issue": "Path Traversal",
    "exploit": "An attacker can provide a relative path (e.g., '../../etc/passwd') as the 'path' parameter. Because the input is concatenated directly to the base directory without validation, the application will serve any file on the filesystem that the process has permissions to read.",
    "fix": "Use os.path.abspath() to resolve the final path and verify that it starts with the intended base directory. Example: \n\nimport os\nbase_dir = os.path.abspath(\"/srv/reports/\")\nfull_path = os.path.abspath(os.path.join(base_dir, path))\nif not full_path.startswith(base_dir):\n    raise HTTPException(403)"
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack on Token Comparison",
    "exploit": "The '!=' operator performs a non-constant-time string comparison. An attacker can measure the time it takes for the server to return a 403 error to guess the 'ADMIN_TOKEN' character by character.",
    "fix": "Use 'secrets.compare_digest()' to perform a constant-time comparison of the provided token against the environment variable."
  }
]
```