duriantaco Hunt GraphQL Boundaries
Treat this card as advisory prioritization. It cannot widen scope, grant an identity, or turn schema discovery into proof.
Workflow
- Confirm the GraphQL endpoint and transport using the canonical surface graph.
- Use declared schema material first. Attempt bounded introspection only when the target and rules permit it.
- Inventory ID-taking queries and mutations, nested object resolvers, aliases, and pagination boundaries without collecting unnecessary values.
- Route GraphQL behavior through
graphql_exploit; useidor_boundaryfor a paired cross-identity object test. - Compare the same operation, variables shape, and selected fields across owner, non-owner, and unauthenticated controls where those identities are explicitly available.
Evidence Gate
Confirm only a replayable security-relevant differential tied to an in-scope resolver or operation. Introspection enabled, verbose errors, field discovery, type names, and different status codes alone remain observations.
Stop Conditions
Stop when identities or controls are unavailable, the endpoint is out of scope, the query cost would violate policy, or results stay ambiguous. Do not use unbounded aliases, nesting, or resource-exhaustion techniques.