Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

50 deep-dives16 vulnerability topicsFollow via RSS

Find a vulnerability guide

Search by vulnerability, technique, tag, or plain-language symptom.

All SQL Injection 8 Cross-Site Scripting 6 Insecure Deserialization 5 GraphQL 4 SSRF 4 XML External Entity 4 Command Injection 3 NoSQL Injection 3 Path Traversal 3 Host Header Injection 2 Open Redirect 2 Remote Code Execution 2 CORS Misconfiguration 1 CRLF Injection 1 LDAP Injection 1 Server-Side Template Injection 1

Tagged #graphql · clear filter

{ user(id: 1043) { email } }

GraphQLBroken Authorization5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

SelfSec TeamJun 23, 2026

Start here{ __schema { types { name } } }

GraphQL4 min read

GraphQL API Security: Introspection, Deep Queries and the Authorization Gap

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

SelfSec TeamJun 23, 2026

{user{posts{author{posts{id}}}}}

GraphQLDenial of Service4 min read

GraphQL Denial of Service: Deeply Nested and Aliased Queries

GraphQL lets the client decide how much work the server does. Without depth limits, cost analysis and batching caps, a single small request can amplify into enormous server load. Here is how nesting, aliasing and batching turn one query into a denial of service, and how to bound it.

SelfSec TeamJun 23, 2026

Did you mean "user"?

GraphQLIntrospection4 min read

GraphQL Introspection: Mapping a Hidden Schema in One Query

Introspection is built into every GraphQL server, and by default it hands any client a complete map of your type system. Here is how a single query dumps every query, mutation and hidden field, how field suggestions leak the schema even when introspection is off, and how to lock it down.

SelfSec TeamJun 23, 2026