Defend the graph
A GraphQL API needs controls the single endpoint doesn't give you for free:
Tip: Turn off introspection (and the GraphiQL playground) in production, enforce authorization on every field and object — not just at the entry point — and limit query depth, complexity and batching to prevent denial of service. Treat every query argument as untrusted input, exactly like any other endpoint.