[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Directory Escape",
    "exploit": "An attacker can supply `path=../../etc/passwd` to escape the `/srv/reports/` directory and read arbitrary files from the server filesystem.",
    "fix": "Validate and sanitize the `path` parameter. Use `os.path.realpath()` or `pathlib.Path.resolve()` to resolve the absolute path and verify it starts with the intended base directory. Alternatively, use a whitelist of allowed filenames or map input to safe database IDs."
  },
  {
    "severity": "Medium",
    "issue": "Authentication Token in Query Parameter",
    "exploit": "GET requests log query parameters in web server access logs, proxy logs, and browser history, exposing the admin token to unauthorized parties.",
    "fix": "Move the token to an HTTP header (e.g., `Authorization: Bearer <token>`) instead of a query parameter. Update the route to read from headers or cookies."
  },
  {
    "severity": "Low",
    "issue": "Unhandled Missing Environment Variable",
    "exploit": "If `ADMIN_TOKEN` is not set, `os.environ[\"ADMIN_TOKEN\"]` raises a `KeyError`, causing a 500 Internal Server Error that may leak stack traces or internal environment details.",
    "fix": "Use `os.environ.get(\"ADMIN_TOKEN\")` with a fallback or raise a clear startup error. Ensure global exception handlers do not expose stack traces in production."
  }
]