GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls

A penetration tester sends a POST with the SHA-256 hash of a deeply-nested query to an endpoint where...