super-review:graphql

What problem does it solve?

GraphQL APIs often ship with subtle denial-of-service, authorization, and correctness weaknesses that linters miss and review comments can easily get wrong without concrete evidence.

Core Features & Use Cases

• DoS surface review: Detects missing query depth limits, missing query complexity/cost controls, and introspection exposure in production.
• AuthZ and data-leak prevention: Flags missing field-level authorization, unsafe Federation entity handling, and subscription authorization gaps.
• Performance and resilience patterns: Catches N+1 resolver patterns, unbounded list fields without pagination, and unsafe error formatting that leaks stack traces or DB details.
• Protocol hygiene for attackers: Looks for alias abuse bypasses of rate limiting and persisted-query enforcement gaps.

Quick Start

Ask the AI to review a PR that updates GraphQL schema/resolvers for DoS, authorization, pagination, N+1, and error-leak risks with exact quoted evidence from the diff.