Audit GraphQL endpoints for public introspection schemas, circular query DoS, and field-level auth leaks.
Queries __schema introspection in production, builds recursive nested queries to test depth limiting, and validates batch request throttling.
Canonical test payload dispatched during security surface audits.
{ __schema { types { name fields { name } } } }Watch the probe engine test this signature in an isolated sandbox.
Disable Introspection in Production
const server = new ApolloServer({ typeDefs, resolvers, introspection: true });const server = new ApolloServer({
typeDefs,
resolvers,
introspection: process.env.NODE_ENV !== 'production'
});Disable GraphQL introspection in production environments to avoid leaking full schema and hidden admin queries.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for GraphQL Security Scanner.
Checks commonly evaluated alongside GraphQL Security Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.