You could always run dynamic GraphQL in development, then switch to code generation and pre-registered queries in production. We've been looking at doing this a

You could always run dynamic GraphQL in development, then switch to code generation and pre-registered queries in production. We've been looking at doing this as a way to lock down the API and stop potential DoS attacks more ruthlessly.