GraphQL Introspection On in Production? The Tyre Pump

2026-11-03

Thursday, 12:40. You are standing at a petrol station with a half-eaten sandwich in one hand and your phone in the other.

The tyre pump beside you hisses. You are supposed to be checking the pressure before the drive to a client meeting. Instead you are reading a message from a friend who builds front ends.

"Hey, no pressure, but I opened your API in a schema explorer for fun. The whole thing loads. Every type, every field. Is that meant to be public?"

You read it twice. Introspection. You turned it on during development because the tooling loved it. Somewhere between the staging deploy and the Friday release, nobody turned it off. Nobody even wrote it on a list.

The sandwich goes cold

Your first thought is a flat, hot oh no.

Your second thought is worse: what else did I leave on?

You stand there while a van pulls up behind you. You try to remember. The debug flag. The error messages. The admin route you added for a quick test. Did you ever check what the API returns when someone asks for something that isn't theirs?

You don't know. That is the real feeling. It isn't the schema. It's that you can't answer the question with certainty.

You open the laptop on the passenger seat, right there in the car. You start clicking through the code. Twenty minutes later you have found nothing dramatic and fixed one thing. And yet your chest is no lighter, because finding nothing is not the same as knowing.

The meeting you half attended

The client meeting is friendly. Coffee, a slide deck, someone asking about your timeline.

You nod in the right places. Behind your eyes a second meeting is running: Is this the only thing? Would I even know?

On the drive home you replay it. A schema being visible isn't automatically a disaster. You know that. It's a map, not a key. But a map is what makes the next question easy for someone curious, and you can't shake the thought that you launched without ever deciding what should be visible. You didn't decide. You just shipped.

That is the quiet cost nobody mentions. It isn't the incident. It's the low hum afterwards. The glance at the logs before bed. The Sunday lunch where you're only half there. The feeling that you are a person who builds things for other people and can't quite vouch for them.

What the friend's message actually said

That evening you reread the message, and this time you read it differently.

Your friend didn't write you've been hacked. He wrote is that meant to be public? A fair, ordinary question. The kind a colleague, a client or a customer's security person will ask one day, perhaps less kindly.

And you realise you have no good answer ready, not because the work is bad, but because the checking was never a thing you did on purpose. It lived in your head, as a vague I think I handled that.

That is the turning point. The problem was never a missing clever trick. It was that there was no list. No place where "is this meant to be public?" had a box next to it, with a tick or a note saying decided, and here is why.

A different kind of Monday

Picture the same API, three weeks later.

Nothing about it is more glamorous. But on Monday morning you open one document. Every line has a status: checked, fixed, or knowingly accepted. When a client asks, "Is your API secure?", you don't tense up. You send a short, tidy summary of what was reviewed and what was found.

The petrol station moment, had it happened now, would be a two-minute reply: "Thanks for the heads-up, that one is on my list and already decided." Then you'd finish the sandwich.

That is all calm is here. Not a perfect system. A system you can see.

You would still find things. Everybody does. But you'd find them on a Tuesday afternoon with a coffee, not in a car park with your heart beating in your ears.

If you recognise the car park

One honest note first. The kit below is built around REST APIs (Node/Express and Python), not GraphQL specifically, and it won't turn off your introspection for you. What it does is give you the habit that was missing: a structured pass through the things an API tends to leave open, with a tracker, some simple tests and a report you can hand to a client.

If the question "what else did I forget?" has ever followed you home, it might be a gentle next step. It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit – a 58-item review kit with a PDF and XLSX tracker, curl tests, an auth-route scanner script and a client report template. It supports your own review and does not replace a professional security audit.

The tyre pressure, by the way, was fine. It usually is. It is just nicer to know.

An illustrative story, written with AI assistance.