Security Test: GraphQL IDE¶

Description¶

Default Severity: low

A GraphQL IDE is a tool that lets you interact with your GraphQL endpoint, but if it's not properly secured, it can reveal too much about your API’s inner workings. This extra information might help an attacker craft harmful queries or even overload your system, leading to potential data leaks or service disruptions. Often, developers forget to disable introspection and other development-only features when moving to production, which leaves the door open for attackers who exploit these weaknesses. It's important to lock down access and carefully control what the IDE exposes so that your API doesn’t inadvertently hand out its blueprint to the wrong people.

Configuration¶

Identifier: configuration/ide_enabled

Examples¶

All configuration available:

checks:
  configuration/ide_enabled:
    skip: false # default

Compliance and Standards¶