We agree, with any GraphQL API you need to make sure it is hardened for production.

We are looking to add more on documentation on this soon and maybe a tutorial series on exactly this.