What happened

GET /shutdown called exitProcess(0) after a short delay, terminating the whole server process. It sat behind authenticate("auth-api-key"), so it required the shared cluster bearer token — but as a side-effecting GET, it violated the basic REST safety guarantee that GET requests don’t change server state. Found during the public-demo exposure audit (krill#915/#916); demo mode already hard-blocks the route, but a normal (non-demo) server still exposed it.

Root cause

Mutating operations were modeled as plain GET routes instead of POST, so anything that can induce a GET against the server with the right credential attached — a browser prefetch, a crawler following a stray link, a same-origin script — could trigger a full process exit with no confirmation step. The route also had no consumer anywhere in composeApp/androidApp/iosApp or krill-oss (krill-mcp operates on node CRUD via the authenticated API, not a raw HTTP shutdown probe), and systemctl stop krill already covers the operator use case the route was meant to serve.

Fix

• Removed GET /shutdown from server/.../Routes.kt entirely, along with the scope: CoroutineScope parameter it was the sole user of in configureSystemRoutes.
• Added ShutdownRouteRemovedTest (server/src/jvmTest/.../Routes package) asserting the route string is gone from Routes.kt, so it can’t silently come back.

Prevention

• Side-effecting operations must be POST (or DELETE), never GET — GET is defined as safe/idempotent, and browsers, proxies, and crawlers rely on that guarantee to prefetch or follow links without side effects. A bearer-token check on a GET route doesn’t fix this: it only narrows who can trigger the effect, not the transport-level assumption that GETs are harmless.
• Dead code that also happens to be a live vulnerability should be deleted, not gated. /shutdown had no client consumer; the operator path (systemctl stop krill) already existed. Removing it converts “unused and dangerous” into “gone” rather than adding a same-host check to preserve a surface nothing used — same call made for /krill-token in krill#916.
• A full testApplication harness isn’t usable in :server:jvmTest today — the pinned ktor-server-tests:2.3.13 test classpath throws NoClassDefFoundError against this module’s ktor-server-core 3.4.x application/environment API. Route-removal regressions in this module need a source-level guard until that gap is closed.