super-review:graphql

Review a GraphQL PR by evaluating schema and resolver diffs for missing field-level authorization, unsafe Federation entity handling, and subscription authorization gaps to prevent data leaks and access control bypasses.

Common GraphQL DoS vulnerabilities include missing query depth limits, absent query complexity controls, and introspection exposure in production. You can detect these by analyzing schema diffs for unbounded depth and missing cost analysis configurations.

Catch N+1 resolver problems and unbounded list fields by inspecting resolver implementations for missing DataLoader-driven batching and checking that list fields enforce pagination caps to prevent unbounded data fetching.

Yes, the review approach applies when diffs touch GraphQL SDL or resolver implementations, and explicitly supports projects with Apollo or Ariadne-style dependencies to evaluate authorization, performance, and protocol hygiene.

GraphQL APIs leak stack traces and database details due to unsafe error formatting in resolvers. Reviewing error handling logic in the diff ensures sensitive implementation details are filtered from API responses.

Enforce persisted queries and prevent alias abuse by reviewing GraphQL protocol configurations to identify rate limiting bypasses and gaps in persisted-query enforcement within the API layer.