```json
[
  {
    "severity": "Critical",
    "issue": "Path Traversal",
    "exploit": "An attacker can supply a `path` parameter containing directory traversal sequences (e.g., `path=../../etc/passwd`) to bypass the intended directory restriction and read arbitrary files on the host filesystem.",
    "fix": "Resolve the full path using `pathlib` and strictly verify it remains within the allowed base directory before serving. Example: `target = (Path('/srv/reports') / path).resolve(); if not target.is_relative_to(Path('/srv/reports').resolve()): raise HTTPException(403)`"
  },
  {
    "severity": "Medium",
    "issue": "Static Authentication Token",
    "exploit": "The endpoint relies on a single, non-expiring secret stored in an environment variable. If the token is leaked, guessed, or reused across environments, an attacker gains persistent, unrevocable access. Lack of rotation and auditability increases risk.",
    "fix": "Replace with a standard authentication mechanism (e.g., JWT, OAuth2, or rotating API keys) that supports expiration, secure storage, and access logging. Avoid using static secrets for access control."
  }
]
```