Checks catalog
All 57 checks, mapped to the OWASP API Security Top 10. FREE checks ship with Community.
IDNameCategoryOWASPSeverity
GQL-001Introspection EnabledFREEDiscovery & Information DisclosureAPI8:2023HIGH
GQL-002Introspection Bypass via __typeFREEDiscovery & Information DisclosureAPI8:2023HIGH
GQL-003Schema Exposed via Field SuggestionsFREEDiscovery & Information DisclosureAPI8:2023MED
GQL-004GraphQL Playground ExposedFREEDiscovery & Information DisclosureAPI8:2023MED
GQL-005Stack Trace / Debug Info in Error ResponsesFREEDiscovery & Information DisclosureAPI8:2023MED
GQL-006Sensitive Fields Exposed in SchemaFREEDiscovery & Information DisclosureAPI3:2023INFO
GQL-M03Sensitive Data in GraphQL extensions / TracingFREEDiscovery & Information DisclosureAPI8:2023MED
GQL-M04Introspection Reachable via Alternative TransportFREEDiscovery & Information DisclosureAPI8:2023MED
GQL-M05Schema Reconstructed via Field SuggestionsPRODiscovery & Information DisclosureAPI8:2023MED
GQL-M06Debug Mode / Dev Tooling ExposedFREEDiscovery & Information DisclosureAPI8:2023LOW
GQL-M09Secrets/Hints Leaked in Schema Descriptions & DefaultsFREEDiscovery & Information DisclosureAPI8:2023LOW
GQL-A01Broken Object Level Authorization (BOLA/IDOR)PROAuthorization & Access ControlAPI1:2023CRIT
GQL-A02Broken Function Level Authorization (BFLA)PROAuthorization & Access ControlAPI5:2023CRIT
GQL-A03Field-Level Authorization (BOPLA / Excessive Data Exposure)PROAuthorization & Access ControlAPI3:2023HIGH
GQL-A04Cross-Tenant Isolation FailurePROAuthorization & Access ControlAPI1:2023CRIT
GQL-A05Mutation-Side Authorization (Non-Owner Write/Delete)PROAuthorization & Access ControlAPI5:2023CRIT
GQL-A06Auth Bypass via Aliases (Rate-Limit/Brute-Force Bypass)PROAuthorization & Access ControlAPI4:2023HIGH
GQL-A09Subscription Authorization Bypass (WebSocket)PROAuthorization & Access ControlAPI5:2023HIGH
GQL-A10Authorization Bypass via Directive/Alias/Fragment SmugglingPROAuthorization & Access ControlAPI5:2023HIGH
GQL-AI01AI-Assisted Value MutationPROAuthorization & Access ControlAPI3:2023MED
GQL-B02Mass Assignment via Input ObjectsPROAuthorization & Access ControlAPI3:2023HIGH
GQL-B01Unrestricted Access to Sensitive Business FlowsPROAuthorization & Access ControlAPI6:2023HIGH
GQL-B03Race Condition (Parallel Mutation)PROAuthorization & Access ControlAPI6:2023HIGH
GQL-I01Boolean-Based SQL InjectionPROInjectionAPI8:2023CRIT
GQL-I02Time-Based Blind SQL InjectionPROInjectionAPI8:2023CRIT
GQL-I03NoSQL (MongoDB) Operator InjectionPROInjectionAPI8:2023CRIT
GQL-I04OS Command InjectionPROInjectionAPI8:2023CRIT
GQL-I05SSRF via GraphQL ArgumentsPROInjectionAPI7:2023CRIT
GQL-I06Cross-Site Scripting (Reflected/Stored via GraphQL)PROInjectionAPI8:2023MED
GQL-I07ORM/GraphQL Operator InjectionPROInjectionAPI1:2023HIGH
GQL-I08LDAP / XML / Template InjectionPROInjectionAPI8:2023HIGH
GQL-I10SQL Injection (Error-Based)PROInjectionAPI8:2023HIGH
GQL-007Query Depth Limit Not EnforcedPRODenial of ServiceAPI4:2023HIGH
GQL-008Query Complexity Limit Not EnforcedPRODenial of ServiceAPI4:2023HIGH
GQL-009Batch Query AbusePRODenial of ServiceAPI4:2023HIGH
GQL-D01Alias-Based Query AmplificationPRODenial of ServiceAPI4:2023HIGH
GQL-D02Field Duplication / __typename FloodingPRODenial of ServiceAPI4:2023HIGH
GQL-D03Circular Fragment SpreadPRODenial of ServiceAPI4:2023HIGH
GQL-D04Directive OverloadingPRODenial of ServiceAPI4:2023MED
GQL-D05Unbounded List/Pagination ArgumentPRODenial of ServiceAPI4:2023HIGH
GQL-D06Query Cost AmplificationPRODenial of ServiceAPI4:2023MED
GQL-D08Unbounded Introspection AmplificationPRODenial of ServiceAPI4:2023LOW
GQL-D07Persisted Query / APQ Not EnforcedPROPersisted Queries & APQAPI4:2023MED
GQL-D09Persisted Query Fingerprint & APQ HandshakePROPersisted Queries & APQAPI4:2023INFO
GQL-D10Persisted Query Security-Control BypassPROPersisted Queries & APQAPI8:2023HIGH
GQL-D11Persisted-Query Variable/Value BypassPROPersisted Queries & APQAPI1:2023HIGH
GQL-D12Persisted-Query Cache Abuse (Fill DoS / Hash Fuzzing)PROPersisted Queries & APQAPI4:2023MED
GQL-D13Persisted-Query Cross-User Cache Poisoning / WAF BypassPROPersisted Queries & APQAPI1:2023HIGH
GQL-012Unauthenticated Access to MutationsPROAuthentication & SessionAPI2:2023HIGH
GQL-A07GraphQL CSRF (State Change via GET / Simple Content-Type)PROAuthentication & SessionAPI8:2023HIGH
GQL-A08JWT Authentication-Token WeaknessesPROAuthentication & SessionAPI2:2023HIGH
GQL-B04User/Identifier EnumerationPROAuthentication & SessionAPI1:2023MED
GQL-010GraphQL GET Queries EnabledFREEConfiguration & HardeningAPI8:2023MED
GQL-M07CORS MisconfigurationFREEConfiguration & HardeningAPI8:2023MED
GQL-M08Missing Security HeadersFREEConfiguration & HardeningAPI8:2023LOW
GQL-M01GraphQL Engine FingerprintFREEServer Intelligence & FingerprintingAPI8:2023INFO
GQL-M02Known Engine CVEsPROServer Intelligence & FingerprintingAPI8:2023INFO