{"id":3578,"url":"https://github.com/Escape-Technologies/awesome-graphql-security","name":"awesome-graphql-security","description":"A curated list of awesome GraphQL Security frameworks, libraries, software and resources","projects_count":47,"last_synced_at":"2026-07-17T21:00:37.018Z","repository":{"id":41514992,"uuid":"499765079","full_name":"Escape-Technologies/awesome-graphql-security","owner":"Escape-Technologies","description":"A curated list of awesome GraphQL Security frameworks, libraries, software and resources","archived":false,"fork":false,"pushed_at":"2026-05-05T10:08:20.000Z","size":44,"stargazers_count":395,"open_issues_count":3,"forks_count":34,"subscribers_count":7,"default_branch":"main","last_synced_at":"2026-06-12T06:04:39.378Z","etag":null,"topics":["awesome","awesome-list","graphql","security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Escape-Technologies.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-06-04T08:12:45.000Z","updated_at":"2026-06-06T16:58:45.000Z","dependencies_parsed_at":"2023-11-14T17:25:47.359Z","dependency_job_id":"963d831e-2f68-48c6-b86c-1ce8c3c2bd2d","html_url":"https://github.com/Escape-Technologies/awesome-graphql-security","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Escape-Technologies/awesome-graphql-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Escape-Technologies%2Fawesome-graphql-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Escape-Technologies%2Fawesome-graphql-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Escape-Technologies%2Fawesome-graphql-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Escape-Technologies%2Fawesome-graphql-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Escape-Technologies","download_url":"https://codeload.github.com/Escape-Technologies/awesome-graphql-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Escape-Technologies%2Fawesome-graphql-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34923767,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-29T02:00:05.398Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-06T00:25:59.444Z","updated_at":"2026-07-17T21:00:37.018Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Neutral Security","Defensive Security","Resources","Papers","Contributing","🤝 Join our team","Offensive Security"],"sub_categories":["Clients and IDEs","Security Solutions","Blogs","Academy","Visualizers","Vulnerabilities","Authentication \u0026 Authorization","Discovery","Exploitation","Self-Discovery","Vulnerable Applications","Middlewares","Continous Security Testing"],"readme":"\u003c!--lint disable awesome-list-item awesome-toc--\u003e\n\n# Awesome GraphQL Security [![awesome](https://awesome.re/badge-flat2.svg)](https://awesome.re)\n\nA curated list of awesome GraphQL Security frameworks, libraries, software, and resources.\n\n## Contents\n\n- [Defensive Security](#defensive-security)\n  - [Authentication \u0026 Authorization](#authentication--authorization)\n  - [Continous Security Testing](#continous-security-testing)\n  - [Middlewares](#middlewares)\n  - [Security Solutions](#security-solutions)\n- [Neutral Security](#neutral-security)\n  - [Clients and IDEs](#clients-and-ides)\n  - [Self-Discovery](#self-discovery)\n  - [Visualizers](#visualizers)\n- [Offensive Security](#offensive-security)\n  - [Discovery](#discovery)\n  - [Exploitation](#exploitation)\n  - [Vulnerable Applications](#vulnerable-applications)\n- [Resources](#resources)\n  - [Blogs](#blogs)\n  - [Vulnerabilities](#vulnerabilities)\n\n## Defensive Security\n\n### Authentication \u0026 Authorization\n\n- [GraphQL Shield](https://github.com/maticzav/graphql-shield) - Helps you create a permission layer for your application.\n- [GraphQL Authz](https://github.com/AstrumU/graphql-authz) - GraphQL authorization layer\n\n### Continous Security Testing\n\n- [Escape - GraphQL Security](https://escape.tech) - Continuous GraphQL Security Testing for Developers. Find and fix GraphQL security flaws in the CI/CD.\n- [GraphQL Cop](https://github.com/dolevf/graphql-cop) - Utility to run common security tests against GraphQL APIs that can be run inside CI/CD.\n\n### Middlewares\n\n- [GraphQL Armor](https://github.com/Escape-Technologies/graphql-armor) - Highly customizable security middleware for Apollo GraphQL and Envelop servers.\n\n### Security Solutions\n\n- [WAF for GraphQL](https://lab.wallarm.com/api-security-solution/) - Web Application Firewall for GraphQL APIs.\n\n## Neutral Security\n\n### Clients and IDEs\n\n- [Postman](https://www.postman.com/) - An API platform for developers to design, build, test and iterate their APIs.\n- [Insomnia](https://insomnia.rest/) - Design and test GraphQL APIs with ease.\n- [Altair](https://altairgraphql.dev/) - GraphQL Client helps you debug GraphQL queries and implementations. Also distributed as a Browser Extension.\n- [Hoppscotch](https://github.com/hoppscotch/hoppscotch) - Online REST and GraphQL client\n\n### Self-Discovery\n\n- [GraphMan](https://github.com/Escape-Technologies/graphman) - Generate a complete Postman collection from a GraphQL endpoint. Allows instant and easy discovery and exploration of the API.\n\n### Visualizers\n\n- [Voyager](https://github.com/IvanGoncharov/graphql-voyager) - Represent any GraphQL API as an interactive graph.\n- [GraphQL Inspector](https://github.com/kamilkisiela/graphql-inspector) – Validate schema, get schema change notifications, validate operations, find breaking changes, look for similar types, schema coverage.\n- [GraphQL Rover](https://github.com/Brbb/graphql-rover) - GraphQL schema viewer for endpoints with introspection\n- [CraftQL](https://github.com/yamafaktory/craftql) - CLI GraphQL schema viewer, view schema diagram on the terminal or generate graphviz .dot format file\n\n## Offensive Security\n\n### Discovery\n\n- [Graphinder](https://github.com/Escape-Technologies/graphinder) - Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.\n- [Graphw00f](https://github.com/dolevf/graphw00f) - GraphQL Server Engine Fingerprinting utility.\n- [Clairvoyance](https://github.com/nikitastupin/clairvoyance) - Patrial introspection fetcher when introspection is disabled.\n- [GraphQL Path Enum](https://gitlab.com/dee-see/graphql-path-enum) – Tool that lists the different ways of reaching a given type in a GraphQL schema.\n- [ShapeShifter](https://github.com/szski/shapeshifter) - Schema extraction to JSON file with introspection.\n- [Goctopus](https://github.com/Escape-Technologies/goctopus) - a GraphQL endpoint discovery and fingerprinting tool.\n\n### Exploitation\n\n- [GraphCrawler](https://github.com/gsmith257-cyber/GraphCrawler) - A GraphQL automated security toolkit. Grab introspection, search for sensitive queries, and then test authorization.\n- [CrackQL](https://github.com/nicholasaleks/CrackQL) - GraphQL password brute-force and fuzzing utility.\n- [GraphQLMap](https://github.com/swisskyrepo/GraphQLmap) - A scripting engine to interact with a GraphQL endpoint for pentesting purposes.\n- [GraphQL.Security](https://graphql.security) - One-click quick security scan of your GraphQL endpoints. Free, no login required.\n- [GraphQL Threat Matrix](https://github.com/nicholasaleks/graphql-threat-matrix) - GraphQL threat framework to research security gaps in GraphQL implementations.\n- [InQL](https://github.com/doyensec/inql) - A Burp Extension for GraphQL Security Testing.\n- [BatchQL](https://github.com/assetnote/batchql) - GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.\n- [GraphQL wordlist](https://github.com/Escape-Technologies/graphql-wordlist) - the only GraphQL wordlist for pentesting you'll ever need. Operations, field names, type names. It was collected on more than 60k distinct GraphQL schemas.\n\n### Vulnerable Applications\n\n- [Damn Vulnerable GraphQL Application](https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application) - An intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. \n\n## Resources\n\n### Blogs\n\n- [Access Control Best Practices for GraphQL with Authentication and Authorization](https://escape.tech/blog/authentication-authorization-access-control/) - Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.\n- [Apollo Blog](https://www.apollographql.com/blog/graphql/security/9-ways-to-secure-your-graphql-api-security-checklist/) - Take your GraphQL skills to the next level with our free interactive GraphQL tutorials, videos, quizzes and code challenges.\n- [The GraphQL Security Blog](https://escape.tech/blog/9-graphql-security-best-practices/) - Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem.\n- [GraphQL for Pentesters](https://www.acceis.fr/graphql-for-pentesters/) - Introduction to Basic Concepts, Security Considerations \u0026 Reconnaissance, Vulnerabilities and Attacks, Offensive Tools.\n- [GraphQL security for decentralized applications (DApps): challenges and best practices](https://escape.tech/blog/graphql-security-for-dapps/) - Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem.\n- [Implementing GraphQL Authorization: A Practical Guide](https://www.permit.io/blog/implementing-graphql-authorization) - Learn how to implement scalable authorization in GraphQL. Simplify RBAC and Permissions management with step-by-step instructions.\n\n## Papers\n\n- [Enhancing GraphQL Security by Detecting Malicious Queries Using Large Language Models, Sentence Transformers, and Convolutional Neural Networks](https://www.researchgate.net/publication/394539388_Enhancing_GraphQL_Security_by_Detecting_Malicious_Queries_Using_Large_Language_Models_Sentence_Transformers_and_Convolutional_Neural_Networks)\n\n### Vulnerabilities\n\n- [Aliasing Attacks](https://escape.tech/blog/graphql-batch-attacks-cause-dos/) - Addressing the Security concerns of GraphQL Aliases.\n- [File Inclusion and Directory Traversal](https://escape.tech/blog/file-inclusion-directory-traversal-graphql/) - Reading arbitrary server files through unvalidated path parameters in GraphQL.\n- [GraphQL CSRF](https://escape.tech/blog/understanding-and-dealing-with-cross-site-request-forgery-attacks/) - Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL.\n- [GraphQL Cyclic Queries and Depth Limiting](https://escape.tech/blog/cyclic-queries-and-depth-limit/) - The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash.\n- [HTTPS and GraphQL](https://escape.tech/blog/prevent-data-leaks-with-https/) - How HTTPS can prevent Data Leaks.\n- [SQL Injection](https://escape.tech/blog/sql-injection-in-graphql/) - SQL Injections in GraphQL.\n- [Verbose Errors Suggestions](https://escape.tech/blog/graphql-verbose-error-suggestions/) - When GraphQL Error Messages become a Security Issue.\n- [What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them](https://escape.tech/blog/idor-in-graphql/) - When GraphQL Error Messages become a Security Issue.\n\n## Contributing\n\nYour contributions are always welcome! Please take a look at the [contribution guidelines](https://github.com/Escape-Technologies/awesome-graphql-security/blob/main/CONTRIBUTING.md) first.\n\nWe will keep some pull requests open if we are not sure whether those libraries are awesome, you could [vote for them](https://github.com/Escape-Technologies/awesome-graphql-security/pulls) by adding :+1: to them.\n\n---\n\nIf you have any question about this opinionated list, do not hesitate to contact us [@escapetechHQ](https://twitter.com/escapetechHQ) on Twitter or open an issue on GitHub.\n\n## 🤝 Join our team  \n\nWe believe it's time to bring more AI-driven innovation to cybersecurity, and we'd love your help in building this dream! Want to join our adventure? Check out our [**Careers**](https://jobs.escape.tech) page!\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/escape-technologies%2Fawesome-graphql-security/projects"}