Which of these routes can anyone call, and which transaction blocks the server?
Paste or drop the Kotlin behind one Ktor service - the Application module and its plugins, the routes,
the services, the Exposed tables and repositories. Your browser reads every file and checks it:
a DELETE route outside authenticate { }, runBlocking in a
handler, anyHost() with credentials, a StatusPages handler that sends
cause.message, a JWT verifier with no audience, call.parameters["id"]!!,
a call.respond with no return, transaction { } blocking a coroutine,
SQL built from "$owner", update { } with no where, a query per row, no
connection pool. Free, before you sign in, and nothing is uploaded. Then pick a lane: the
server audit or the data audit gives exact edits for each finding, or the
fix lane writes the whole fixed files - and the page re-checks all three.
The companies and values in the examples are invented. The first is a server audit (it also carries a saved fix run of its edited code, one click after the audit), the second a data audit (switch to the fix lane for its saved fix run), the third is ready on both audits (switch lanes to see the second), the last a fix run; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The server audit rates auth, handlers, errors and threads, confirms or dismisses every server flag below, adds what rules cannot see, and gives exact before/after edits for each finding - which the page applies to your paste and re-checks.
What this does, and what it does not
The check is a reading of the text, not a compiler: nothing is built or run. Each Kotlin file is lexed so
strings, string templates, raw strings and comments are never mistaken for code, and its braces are
rebuilt so each class, fun, lambda, loop and try/catch has its exact extent.
Every route handler is followed through its route(...) prefixes and, when it lives in a
Route extension function, to the place routing { } mounts it - so the page knows
its full path and whether an authenticate { } block covers it. Every Exposed transaction is
read with the fun it is in, whether it blocks, whether coroutine code runs it, and what it writes. Each
flag carries the catalogue id it comes from and the line it points at. Checks only see what you paste: a
plugin installed in a file you did not paste, an application.conf value, the database's indexes and how
many instances run are outside the check (noted, not assumed), and your tests remain the ground truth.
The paid lanes see your paste and the page's facts. Every quote and edit they return is checked against your paste, every edit and every returned file is put back and re-checked, and a reply that repeats a credential from your paste is called out. A paste stays in this browser unless you run a lane. Derived from two agent skills by Affaan Mustafa (affaan-m/everything-claude-code, MIT): @affaan-m/kotlin-ktor-patterns and @affaan-m/kotlin-exposed-patterns. Sources are listed in llms.txt.