What security risks are specific to GraphQL, and how do you test for them?

GraphQL's flexibility creates a distinct security surface. The main risks and their tests:

1. Introspection exposure — __schema reveals the whole API. Test that production disables it (and dev enables it intentionally).
2. Query depth / complexity DoS — client-built queries can be made arbitrarily expensive. Test that depth and cost limits reject abusive queries.
3. Nested authorisation bypass — a query traversing into nested fields can leak data if authz is only at the root. Test field/object-level authz (see the nested-authz question).
4. Injection — SQL/NoSQL injection still applies through resolver arguments. Test that inputs passed as variables are handled safely and that interpolation isn't happening server-side.
5. Batching abuse — GraphQL allows batched operations/aliases; an attacker can use aliases to brute-force (e.g. many login attempts in one request, bypassing naive rate limits). Test that rate limiting accounts for aliased/batched operations.

Pair this with a tool like Pynt for automated API security scanning driven from functional tests, and standard DAST tooling. The QA mindset: GraphQL's "ask for anything" power is also its attack surface.