[
  {
    "severity": "Critical",
    "issue": "Path Traversal / Arbitrary File Read",
    "exploit": "Attacker supplies malicious path values (e.g., `../../etc/passwd` or `../config/.env`) to escape the `/srv/reports/` directory and read arbitrary files from the server filesystem.",
    "fix": "Resolve the full path using `pathlib.Path(full).resolve()` and verify it starts with the intended base directory. Reject requests that escape the base directory. Additionally, validate that `path` only contains safe characters (alphanumeric, hyphens, underscores, dots)."
  },
  {
    "severity": "Medium",
    "issue": "Timing Attack Vulnerability on Token Comparison",
    "exploit": "The `!=` operator performs a short-circuit string comparison, which leaks timing information. An attacker can measure response times to guess the token character-by-character.",
    "fix": "Replace `token != os.environ[\"ADMIN_TOKEN\"]` with `secrets.compare_digest(token, os.environ[\"ADMIN_TOKEN\"])` to ensure constant-time comparison."
  },
  {
    "severity": "Medium",
    "issue": "Sensitive Token Exposure via Logging/URL",
    "exploit": "If the token is passed as a query parameter or in the URL path, it will be recorded in web server access logs, proxy logs, and browser history, increasing the risk of credential leakage.",
    "fix": "Pass the token via the `Authorization` header (e.g., `Bearer <token>`). Ensure sensitive headers are excluded from access logs and enforce HTTPS."
  }
]