Some companies/APIs do this on purpose as one of the benefits of graphql is the self documenting nature. If you have a well secured schema this shouldn’t be a problem. If you are doing security through absurdity by having stuff in the schema you don’t want people to discover, you are going to have a bad time.