[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Directory Traversal",
    "exploit": "An attacker can supply a `path` parameter containing `../` sequences (e.g., `../../etc/passwd` or `..%2f..%2fetc%2fpasswd`) to escape the `/srv/reports/` directory and read arbitrary files from the server's filesystem.",
    "fix": "Resolve the constructed path using `os.path.realpath()` or `pathlib.Path.resolve()` and verify it strictly starts with the intended base directory (`/srv/reports/`). Reject the request with a 403/404 if the resolved path escapes the allowed directory."
  },
  {
    "severity": "High",
    "issue": "Sensitive Data Exposure in URL (Token in Query Parameter)",
    "exploit": "The `token` is passed as a query parameter, meaning it will be recorded in web server access logs, reverse proxy logs, browser history, and potentially leaked via the `Referer` header when users navigate away. This facilitates token theft and unauthorized access.",
    "fix": "Pass the authentication token via a secure HTTP header (e.g., `Authorization: Bearer <token>`) or as a POST body parameter. Ensure logging systems redact sensitive headers and enforce HTTPS to protect in-transit credentials."
  }
]