Statement download path traversal

A statement filename with ../ escapes the directory and reads arbitrary server files.

Attack

Download ?file=../../../../etc/passwd.

Nemesis defense

Path-traversal patterns are blocked at the edge and in-app.

Modelled on

Legacy file-download endpoints across the sector.

Endpoint

GET /api/statement