All Security Checks
Vulnerability DetectionA03:2021

GraphQL Security Scanner

Audit your GraphQL API for introspection leaks, injection, and query complexity attacks.

GraphQL APIs have unique security challenges including introspection exposure, query depth attacks, and injection vulnerabilities. Our scanner detects GraphQL endpoints, tests introspection access, checks for query complexity limits, and scans for injection vectors in GraphQL variables.

What This Scanner Does

Discovers GraphQL endpoints, tests introspection queries, checks for query depth/complexity limits, tests for injection in variables and arguments, and verifies authentication on sensitive queries and mutations.

Why It Matters

An exposed GraphQL introspection endpoint reveals your entire API schema to attackers. Without query depth limits, attackers can craft deeply nested queries that crash your server. GraphQL injection can bypass authorization and access unauthorized data.

Common Findings

  • GraphQL introspection enabled in production
  • No query depth or complexity limits
  • Missing authentication on sensitive mutations
  • Injection vulnerabilities in GraphQL variables

OWASP Top 10 Coverage

A03:2021Injection

Run This Check on Your Site

Get a full security report with AI-powered fix suggestions in 30 seconds. No setup required.

Related Security Checks