Sorry but this is simply wrong. If you're generating a GraphQL interface automatically and allow arbitrary requests to your database that's on you. That's abso

Sorry but this is simply wrong. If you're generating a GraphQL interface automatically and allow arbitrary requests to your database that's on you. That's absolutely equivalent to forwarding arbitrary requests to a SQL database. Absolutely nobody ever just forwards GraphQL queries to their database -- unless it's a trusted internal system that acts as a backend for internal services (i.e. Prisma ORM). Any user facing GraphQL API absolutely will have a manually defined schema, especially given the fact that you don't want to break the API contract just because you changed the name of a database column or because you moved some data into another table. This is not equivalent to a SQL injection. If you allow unauthenticated mutations on your dataset or unconstrained access, that's not a design error of the technology you're using, that's simply you using the technology incorrectly.