GraphQL Introspection Scanner
Checks whether your GraphQL endpoint exposes its full API schema via enabled introspection.
What it checks
This scanner checks whether your GraphQL endpoint has introspection enabled, which exposes your API's full schema. It detects when anyone can query the entire structure of available types, fields and operations.
Why it matters
With introspection enabled, an attacker gets a detailed map of your API effortlessly, including internal fields and operations you may not have wanted to reveal. That knowledge makes it much easier for them to find weak points and data to explore.
How to fix it
Disable GraphQL introspection in your production environment, keeping it on only for development. Most GraphQL libraries let you do this with a configuration option based on the environment.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free