GraphQL introspection enabled in production

Why it matters

Unauthenticated APIs, IDOR, admin routes, CORS. This check looks specifically for: graphql introspection enabled in production.

How to fix it

Open the finding in Emerald Red Team for a fix prompt tailored to your stack and AI tool.

How we test it

Passive — runs in the free check, looks only at what a browser can see.