GraphQL Security Checker

A built-in query that returns the complete schema — every type, query, mutation, field and argument. It is what powers GraphiQL and code generation, and it is enabled by default in most servers. Left on in production, it hands an anonymous caller a full map of your API, including the parts not in your documentation.

Not on its own — it discloses design, not data, and authorisation still applies to every field. But it removes all the work from reconnaissance, and it routinely reveals internal mutations and admin fields that were never meant to be publicly known. Most teams intend to disable it in production and simply have not.

Not quite. Most servers also return "Did you mean…" suggestions for misspelt fields, which lets someone reconstruct the schema field by field regardless. Disabling introspection while leaving suggestions on is a common and false sense of security, so both are checked here.

Apollo Server: introspection: false in the constructor. GraphQL Yoga: the graphiql and introspection options. graphql-js directly: add NoSchemaIntrospectionCustomRule to your validation rules. Do it by environment so development keeps its tooling.

Query depth and complexity limits, because a single nested query can be a denial of service; batching limits for the same reason; disabling GraphiQL in production; and per-field authorisation, since a single endpoint means URL-level access control does not work. This tool covers schema exposure, which is the part observable from outside.

Two small POST requests: the standard introspection query, and one deliberately misspelt field name to see whether suggestions are enabled. Both are ordinary GraphQL queries and neither reads or changes any data.