[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Directory Traversal",
    "exploit": "An attacker can supply a path parameter containing '../' sequences (e.g., path=../../etc/passwd) to read arbitrary files on the server filesystem outside the intended /srv/reports/ directory.",
    "fix": "Validate and sanitize the path parameter. Use os.path.realpath() or pathlib to resolve the full path and verify it strictly starts with the allowed base directory (/srv/reports/). Reject any path that escapes this base."
  },
  {
    "severity": "High",
    "issue": "Weak Authentication Mechanism (Static Shared Secret)",
    "exploit": "The endpoint relies on a single static token stored in an environment variable. If this token is leaked, guessed, or intercepted, an attacker gains full access. There is no rate limiting, token rotation, or per-user authentication.",
    "fix": "Implement a robust authentication system (e.g., JWT, OAuth2, or session-based auth). Use secure, randomly generated tokens with expiration, implement rate limiting, and consider role-based access control (RBAC) instead of a single admin token."
  },
  {
    "severity": "Medium",
    "issue": "Missing Input Validation & Path Normalization",
    "exploit": "Without explicit validation, malicious inputs (e.g., null bytes, excessively long paths, or URL-encoded traversal sequences) can bypass simple checks or cause application crashes/DoS.",
    "fix": "Enforce strict input validation: limit path length, restrict allowed characters (alphanumeric, hyphens, underscores, dots), and decode/normalize the path before validation. Use a whitelist approach for allowed filenames if possible."
  }
]