# GraphQL Security Issues

> Detects insecure GraphQL configurations including enabled introspection, unbounded query depth, and missing authentication on resolvers.

- Skill: `zakirkun/graphql-security-issues` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/graphql-security-issues`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/graphql-security-issues/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/graphql-security-issues

---


# GraphQL Security Issues

## Overview
GraphQL APIs have unique security risks:
1. **Introspection enabled in production**: Reveals entire schema to attackers for reconnaissance
2. **Unbounded query depth**: `{ user { friends { friends { friends { ... } } } } }` — DoS via deeply nested queries
3. **Batch query abuse**: Unlimited query batching enables brute force and DoS
4. **Missing resolver-level auth**: Even with authentication, each resolver must check permissions
5. **Verbose error messages**: GraphQL errors often expose internal details

## Remediation
- Disable introspection in production (`introspection: false`)
- Enforce query depth limits (max 5-7 levels)
- Implement query complexity limits
- Use persisted queries to restrict query set
- Add authentication checks in each resolver