GraphQL Security - Escape - Application Security & Offensive Security Blog

GraphQL

The Paradox of Disabling GraphQL Introspection: Lessons from the Parse Server GraphQL API vulnerability

Last week, the security community was alerted to a vulnerability in Parse Server GraphQL API, which allowed public access to the GraphQL schema without requiring a session token or the master key. It is now identified as CVE-2025-53364. So, the question comes up: Should we disable introspection entirely in production environments to prevent such vulnerabilities? Having heard this question time and time again, I’ve already addressed it in past writings, and my stance remains: Disabling introspe

Antoine Carossio

July 17, 2025 4 min read

API Security

The State of GraphQL Security 2024

Insights from 13,000 GraphQL API issues: Read our deep dive into the current state of GraphQL security.

Alexandra Charikova

July 23, 2024 2 min read

GraphQL Security

How to secure GraphQL APIs: challenges and best practices

GraphQL APIs, while offering robust features and flexibility, present unique security challenges compared to traditional REST APIs. This article delves into the complexities of securing GraphQL APIs, highlighting common vulnerabilities and providing a comprehensive guide to best practices for building secure GraphQL apps. A visual learner? Check out our latest webinar on GraphQL security: Why Securing GraphQL is Challenging Complex query capabilities GraphQL APIs allow for complex querie

Alexandra Charikova

April 26, 2024 6 min read

API Security

[Webinar] How to secure GraphQL

Join Uri Goldshtein and Tristan Kalos for a webinar on GraphQL security and learn to secure your GraphQL APIs.

Tristan Kalos

April 15, 2024 1 min read