Unauthenticated GraphQL introspection response was observed
ShipReady sent a read-only schema query to conventional GraphQL paths and received a response containing __schema.
Why it matters
Schema metadata can be useful operationally, so teams should make an intentional production decision about public introspection.
How ShipReady detects it
What it inspects
ShipReady sends the fixed read-only {__schema{queryType{name}}} query to /graphql, /api/graphql, and /v1/graphql.
What triggers a finding
A finding requires HTTP 200 JSON with data.__schema at one of those fixed paths.
What the evidence shows
An unauthenticated request to the reported conventional path returned a __schema object.
Limits of this check
ShipReady does not enumerate the full schema, invoke mutations, test authorization, inspect every GraphQL route, or prove that any operation is vulnerable.
How to fix it
Decide whether unauthenticated introspection is intentional
Review whether the production GraphQL API is meant to expose schema metadata anonymously. Introspection can be a deliberate developer-experience choice; this finding does not establish an authorization failure.
Configure the intended endpoint behavior
If anonymous schema introspection is not intended, change the GraphQL server or gateway configuration and keep authorization controls for operations under separate review.
How to verify the change
Recheck the bounded schema query
After deployment, send the same read-only schema query to the reported conventional GraphQL path and inspect the response.
Expected: No unintentionally public conventional GraphQL path returns a data.__schema object to the bounded unauthenticated query.