Others have been looking at this problem and the possibilities of bringing down your backend with a mischievous request... https://blog.apollographql.com/securing-your-graphql-api-fro... reminds us of `select * from <big table>