Apparently the facebook team (and others in production I'm guessing) addresses some of this by only having a whitelisted set of queries in production. So you ge

Apparently the facebook team (and others in production I'm guessing) addresses some of this by only having a whitelisted set of queries in production. So you get the GraphQL flexibility during development, but a effectively a static set of APIs in production.