Since "@dbquery" is attacker controlled, isn't that @exfiltrate? The examples use Int! for params, so it's unclear how the framework/product deals with interpo

Since "@dbquery" is attacker controlled, isn't that @exfiltrate? The examples use Int! for params, so it's unclear how the framework/product deals with interpolation. While looking up the docs <https://stepzen.com/docs/custom-graphql-directives/directives#-dbquery https://stepzen.com/docs/custom-graphql-directives/directive...> I noticed that your blog uses "$1" and the docs uses ordered "?" Then, I saw this one <https://stepzen.com/docs/custom-graphql-directives/directives#endpoint https://stepzen.com/docs/custom-graphql-directives/directive...> and wondered what happens if I send `@rest(endpoint="http://169.254.169.254 http://169.254.169.254")`