Feedback Driven API exploration at the service of GraphQL Security
Introduction Automating the audit of APIs is a very hard problem: we want to dynamically evaluate those APIs' security, performance, and reliability. But APIs take parameters that are tightly coupled to the underlying business logic. We need a way to know what sequences of requests to send, with what parameters, and in which order to have maximum API coverage to improve the scan quality. A naive automated would also not work: putting random data in parameters would likely not pass the API's
