Test for introspection exposure in production (query `{__schema{types{name}}}`). - Attempt query depth and complexity attacks to identify resource exhaustion possibilities (deeply nested queries, alias-based batching). - Look for field suggestions in error messages that reveal undocumented fields. -