GraphQL - Escape - Application Security & Offensive Security Blog

GraphQL

The Paradox of Disabling GraphQL Introspection: Lessons from the Parse Server GraphQL API vulnerability

Last week, the security community was alerted to a vulnerability in Parse Server GraphQL API, which allowed public access to the GraphQL schema without requiring a session token or the master key. It is now identified as CVE-2025-53364. So, the question comes up: Should we disable introspection entirely in production environments to prevent such vulnerabilities? Having heard this question time and time again, I’ve already addressed it in past writings, and my stance remains: Disabling introspe

Antoine Carossio

July 17, 2025 4 min read

API Security

The State of GraphQL Security 2024

Insights from 13,000 GraphQL API issues: Read our deep dive into the current state of GraphQL security.

Alexandra Charikova

July 23, 2024 2 min read

GraphQL Security

How to secure GraphQL APIs: challenges and best practices

GraphQL APIs, while offering robust features and flexibility, present unique security challenges compared to traditional REST APIs. This article delves into the complexities of securing GraphQL APIs, highlighting common vulnerabilities and providing a comprehensive guide to best practices for building secure GraphQL apps. A visual learner? Check out our latest webinar on GraphQL security: Why Securing GraphQL is Challenging Complex query capabilities GraphQL APIs allow for complex querie

Alexandra Charikova

April 26, 2024 6 min read

API Security

[Webinar] How to secure GraphQL

Join Uri Goldshtein and Tristan Kalos for a webinar on GraphQL security and learn to secure your GraphQL APIs.

Tristan Kalos

April 15, 2024 1 min read

API

API Catalog & API Portal: A handbook of everything you should know

Discover the importance of API catalogs, their differences from API portals & gateways, and how to ensure optimal API management and security.

Nohé Hinniger-Foray

September 26, 2023 9 min read

Announcement

How we found a security misconfiguration in Philips' GraphQL API

It is a misconception that discovering vulnerabilities is only within the domain of developers and hackers. Jacob, an Account Executive at Escape, proves this notion wrong. What is a vulnerability disclosure? Vulnerability disclosure is the process of reporting security weaknesses in computer software or hardware. Individuals and groups such as security researchers, IT security teams, and in-house or third-party developers can report these vulnerabilities to the parties responsible for the af

Escape - Offensive Security

September 19, 2023 3 min read

Announcement

Escape and Xolvio officially partner to help teams secure their GraphQL APIs!

Keeping APIs secure is vital. However, not all organizations have the in-house resources to tackle it effectively. Xolvio's clients can now leverage Escape's expertise in GraphQL security and performance assessments. They can also integrate it into their CI/CD pipelines, enhancing their API security

Alexandra Charikova

September 19, 2023 2 min read

GraphQL

What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them

As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for APIs, is not exempt from this vulnerability. In this blog post, we will dive in detail into what IDOR vulnerabilities are and why they pose a threat to G

Tristan Kalos

September 14, 2023 8 min read

API Security

API Security Academy: How It Works Under the Hood

The API Security Academy is built upon a technology that comes straight from the future—and by that, we mean the brilliant minds at StackBlitz - WebContainers. You may already know regular containers, the ones you can run with Docker and Kubernetes, which are lightweight virtualization units that allow developers to package and run applications in isolated containers. WebContainers are containers that run directly in the browser, pre-charged with a shell and Node.js. You may run anything in the

Gautier Ben Aïm

September 13, 2023 3 min read

GraphQL

API Security Academy: a smarter way to learn GraphQL security

Learning about GraphQL security is now more accessible than ever! We're excited to introduce the API Security Academy, developed by the Escape team. Escape's API Security Academy is a free and open-source collection of interactive challenges that will teach you how to secure your GraphQL applications. The challenges are designed to be fun and engaging, and they will help you learn the following: * How to identify and mitigate security vulnerabilities in GraphQL applications * How to apply Gr

Gautier Ben Aïm

September 12, 2023 3 min read

Web3 Security

GraphQL Security: Challenges & Best Practices for DApps

Apart from the issue of poor user experience, security is one of the greatest setbacks to global Web3. Blackhats are constantly exploiting Web3 applications to siphon funds. On the 2nd of July, 2023, Poly Network lost about $5 million to a hack. Atomic Wallet lost over $100 million to a breach in June 2023. Jimbos Protocol also lost over $7 million to a security bug. But there is a big misconception about the state of DApps security: most people think breaches happen only on smart contracts. In

Escape - Offensive Security

August 24, 2023 6 min read

GraphQL

GraphQL Wordlist: Free Open Source for Penetration Testing

In cybersecurity, the old saying that the "best defense is a good offense" rings true. This philosophy is reflected in the approach we call offensive security. It involves actively seeking out system vulnerabilities to fix them before they can be exploited. It's about taking the initiative, keeping a step ahead of potential threats, and changing how we approach cybersecurity. TL;DR: We built the open source GraphQL wordlist for penetration testing based on 60k+ production GraphQL endpoints. It

Nohé Hinniger-Foray

August 17, 2023 5 min read

GraphQL

Goctopus: Open Source GraphQL Discovery & Fingerprinting

In the fast-evolving domain of APIs, GraphQL has emerged as a powerful, data-oriented language. As its adoption soars, so does the need for robust tools to discover and fingerprint these APIs. Enter Goctopus, a Golang-based solution we developed at Escape to provide comprehensive, fast, and interoperable endpoint discovery and fingerprinting for GraphQL APIs. Engineered to overcome the limitations of existing tools, Goctopus extends its arms into realms of subdomain enumeration, route brute-forc

Nohé Hinniger-Foray

August 10, 2023 7 min read

Announcement

Escape raises $3.9 million in seed to secure APIs at every development stage

Official Press release * Six months after releasing its API security platform, Escape has already secured the applications of 1000+ organizations worldwide and just graduated from Y Combinator. * The funding will allow the company to hire new team members covering European and US-based customers, aiming to double the team’s size in the coming 12 months. If you are interested, take a look at Escape's Open Positions. Paris, Tuesday June 6th 2023 – Escape, the API security company, freshly out

Escape - Offensive Security

June 6, 2023 4 min read

Attack Surface Management

Unveiling the GraphQL API Catalog

Escape launches the first Asset Inventory and Attack Surface Management solution for GraphQL APIs with its new API Catalog feature.

Antoine Carossio

June 1, 2023 3 min read

GraphQL

Introducing Seamless GraphQL Compliance

As your go-to partner in GraphQL Security, we at Escape are constantly innovating to simplify and streamline security for you. We're proud of our reputation for crafting modern, dynamic application security testing (DAST) tools tailored to GraphQL, beloved by developers and trusted by security teams worldwide. From comprehensive reporting features and vulnerability checks to seamless CI/CD integrations and remediation assistance, our platform empowers your security teams to ensure robust GraphQL

Antoine Carossio

May 25, 2023 3 min read

GraphQL Vulnerability

GraphQL XSS: Cross-Site Scripting Explained

Every Monday morning, you go through your ritual and check the users' feedback. This week, despite all the wonderful feedback, some users are complaining that someone has impersonated them and performed actions on their accounts without their knowledge. After some investigation, you discover that all the complaining users have each logged in from different IP addresses in the past week and moreover, one IP address comes up several times on different accounts. So there really could be an attacke

Achraf Ait Sidi Hammou

May 18, 2023 5 min read

GraphQL

GraphQL Input Validation & Sanitization

Why input validation and sanitization are important in GraphQL? GraphQL allows you to identify the data and validate inputs based on type information. By default, GraphQL Specification has the Int, Float, String, Boolean and ID Scalar types. But as a conscious API developer, you've probably come across situations where user input needs to be validated and sanitized before being processed. Input validation and sanitization are essential to ensure your data's integrity, consistency, and s

Antoine Carossio

May 11, 2023 5 min read

GraphQL

Top 5 GraphQL vulnerabilities burdening HIPAA compliance

TL;DR: GraphQL vulnerabilities will inevitably burden organizations, especially when healthcare compliances like HIPAA come into play. This article highlights how Escape makes it super easy to release compliant APIs. The correlation between HIPAA and GraphQL is that PHI resources can be exposed through GraphQL APIs, allowing for a more efficient and flexible way of accessing and querying data. By using GraphQL, healthcare companies can improve the performance of their applications and reduce th

Escape - Offensive Security

April 20, 2023 5 min read

Postman

Find & Fix GraphQL API Security Issues with Postman

Improve the security of your GraphQL API with Escape and Postman Are you tired of dealing with pesky API vulnerabilities? Want to take your GraphQL game to the next level? Introducing the perfect combo for GraphQL success - Escape and Postman. Escape is a tool that helps developers automatically and continuously test their GraphQL API to discover vulnerabilities and suggest ways to fix them. Postman is a widely used software for designing, testing, and maintaining APIs, with solid support for

Nohé Hinniger-Foray

January 17, 2023 3 min read

GraphQL

GraphQL Performance: How to Test & Optimize

Quickly identify potential DoS, Complexity, N+1 issues, and more.

Sophie Boulaaouli

December 22, 2022 4 min read

Pentesting

GraphQL Pentesting: Thinking Outside the Box

The hardest part when pentesting any system is undoubtedly answering the question: 💡How should we think of that? What is meant is "how outside-the-box thinking works?", and "how is a pentester meant to think outside the box?". Although tackling this question might seem like a near impossible task, but a good approach would be giving an example of a vulnerability that required "out of box" thinking, dissecting the thought process behind it while trying to answer the "why?" that might pop up.

Karim Rustom

November 10, 2022 3 min read

GraphQL

How to Secure GraphQL APIs in CI/CD: Best Practice

Secure your GraphQL APIs in CI/CD with Escape DAST that supports GraphQL natively.

Karim Rustom

September 22, 2022 4 min read

GraphQL

GraphQL Security: How to Prevent Data Breaches

Manage your sensitive data in GraphQL applications (PII, passwords, secrets…) We released a new feature in Escape that enables you to detect and fix data leaks with GraphQL. 🚫 The GraphQL Access Control issue, what is it? Access control is the restriction that tells the user who or what can be accessed in your application. When a user can access a forbidden resource, there is an access control vulnerability. Your GraphQL application has a schema that defines the relationship between object

Sophie Boulaaouli

September 20, 2022 3 min read