That's a really good point, kabes.

At Graphcool (https://www.graph.cool) we're working on exactly what you're describing. We're putting a lot of work into optimizing for the best possible performance while providing a powerful and flexible API. The key for this will be combining GraphQL and serverless technologies like AWS Lambda to implement your business logic.

Concerning security: We're currently testing a new permission system with a group of beta testers which leverages the Graph structure of your backend to specify data access rules.