Query whitelisting has been available since beta 1. It is called Allow Lists :) https://docs.hasura.io/1.0/graphql/manual/deployment/allow-l...

We recommend every production app to setup Allow Lists to prevent arbitrary querying.