GraphQL Introspection Enabled

Fires once per GraphQL service when the project constructs a GraphQL server but shows no evidence that schema introspection is disabled — Apollo introspection: false, GraphQL.js NoSchemaIntrospectionCustomRule, graphql-yoga useDisableIntrospection, graphql-java NoIntrospectionGraphqlFieldVisibility, Spring GraphQL introspection.enabled: false, Hot Chocolate .DisableIntrospection(), Strawberry DisableIntrospection, or a GraphQL Armor bundle.

Surfaced as an advisory posture finding: introspection may be gated per environment (env var, feature flag) or blocked at the gateway in ways static analysis cannot see. SDL-only repositories (schema files without server construction) are not flagged — the runtime posture is unknowable there.

Most GraphQL servers enable introspection by default. An introspectable production endpoint hands an attacker the complete schema — every type, field, argument, mutation and deprecated operation — eliminating the reconnaissance cost that REST attackers must pay endpoint by endpoint. Combined with BOLA-style probing or resource-consumption attacks, the schema is the map of exactly what to hit. OWASP API8:2023 — Security Misconfiguration (CWE-200, Exposure of Sensitive Information).

Disable schema introspection in production while keeping it available in development:

Alternatively adopt GraphQL Armor, which disables introspection and adds depth/cost guards in one bundle.