“Denial of service is one of the main pain points of GraphQL because the client is in control of what the response format is going to be, which is quite unique as well.”

Transcript evidence from Nick Aleks and Dolev Farhi -- GraphQL Security.