GraphQL has many benefits especially around speed of development but flexibility comes at a price too. Security hardly seems to come up in these discussions but should probably be front and center. GraphQL presents challenges around controlling access to sensitive data especially in complex datasets where query flaws rear their heads. DDos’ing yourself is also common. Then throw in inconsistent authorization checks, managing rate limits and introspection.