A city GraphQL API leaves introspection enabled in production, revealing the full schema to unauthenticated clients. What is the tester's best framing?
Select an answer to reveal the explanation.
Short Explanation
Publishing the blueprint of the building makes burglary planning easier. Production introspection hands attackers the schema map. Turn it down in prod and still test whether authz actually guards those fields.
Full Explanation
GraphQL introspection exposes types, fields, and operations that accelerate reconnaissance. Production deployments commonly disable or restrict introspection while relying on documentation for developers. Schema visibility does not replace authorization testing for queries and mutations. Spec myths or claims that introspection enforces authz are incorrect.