```json
[
  {
    "severity": "high",
    "issue": "Path traversal vulnerability – the `path` query parameter is concatenated directly to the base directory without validation, allowing access to arbitrary files outside `/srv/reports`.",
    "exploit": "An attacker can request `/download?path=../../../../etc/passwd&token=ADMIN_TOKEN` to read sensitive files.",
    "fix": "Validate and sanitize the `path` value. Use `os.path.join` with the base directory and then check that the resolved path starts with the base directory. Reject or normalize any attempt to escape the base."
  },
  {
    "severity": "low",
    "issue": "Token is transmitted as a query string, which can be logged in server logs, browser history, or proxy logs.",
    "exploit": "An attacker could obtain the token from logs or history and impersonate an admin.",
    "fix": "Transmit the token in an HTTP Authorization header or in the request body instead of the query string."
  }
]
```