[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Arbitrary File Read",
    "exploit": "Attacker supplies the `path` parameter with directory traversal sequences (e.g., `../../etc/passwd`) to escape the intended `/srv/reports/` directory and read arbitrary files from the server filesystem.",
    "fix": "Validate and canonicalize the path before use. Resolve the full path using `os.path.realpath()` or `pathlib.Path.resolve()` and verify it starts with the intended base directory. Reject any input containing `..`, absolute paths, or null bytes."
  },
  {
    "severity": "High",
    "issue": "Sensitive Token Exposed in URL Query Parameter",
    "exploit": "Tokens passed as query parameters are logged by web servers, reverse proxies, and browsers, and appear in browser history and HTTP referrer headers. An attacker or malicious third-party script can capture the token to authenticate as an admin.",
    "fix": "Pass the authentication token via the `Authorization` HTTP header (e.g., `Bearer <token>`) or in a secure, `HttpOnly` cookie instead of a URL query parameter."
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack Vulnerability in Token Comparison",
    "exploit": "Python's `!=` operator for string comparison short-circuits on the first mismatched character. An attacker can measure response times across multiple requests to guess the `ADMIN_TOKEN` character by character.",
    "fix": "Use a constant-time comparison function like `secrets.compare_digest(token, os.environ['ADMIN_TOKEN'])` to prevent timing side-channel attacks."
  }
]