GraphQL, gRPC, WebSocket

Vulkro checks GraphQL, gRPC and WebSocket servers for the misconfigurations that REST checklists miss. These checks run in every vulkro scan.

vulkro scan .
vulkro explain GQL-001     # full explainer for any rule

GraphQL (`GQL-`, `GQL-INTRO-`)

Area	Checks
Introspection	Introspection or a playground left on in production (Apollo, graphql-js, Strawberry, Ariadne, gqlgen, Hot Chocolate); `__schema` reachable through a meta-field allowlist.
Query cost	No depth limit, no complexity analysis, batching with no cap, alias amplification, fragment cycles, unbounded `findMany()` results, N+1 lookups without DataLoader.
Authorization	Mutation or subscription resolver without an auth check, sensitive field without field-level auth, federation `__resolveReference` skipping auth, wide `input` spread into an ORM update.
Operational	Error masking absent, user data in error messages, persisted queries not enforced, endpoint reachable by `GET`, subscriptions over `ws://`.

Area	Checks
Transport	Server without TLS credentials, `grpc.WithInsecure()` or insecure client credentials.
Discovery	Reflection registered without an environment guard.
Auth	Service registered with no interceptor; metadata used as auth with no token check; trailers trusted as a business signal.
Resource limits	No `MaxRecvMsgSize`, unbounded `MaxConcurrentStreams`, streaming handlers that ignore cancellation or never stop.
Leaks	Internal errors returned to the client, logging interceptors that capture full payloads.

Covers Go, Python, Node.js and Rust (tonic) servers.

Rule	Checks
`WS-001`	No origin check on the server (cross-site WebSocket hijacking).
`WS-002`	No auth on the first message.
`WS-003`	Token in the `ws://` URL query string.
`WS-004`	No per-connection rate limit.
`WS-005`	Unbounded message size.
`WS-006`	`permessage-deflate` enabled.
`WS-007`	Socket.IO default namespace accepts everything.
`WS-008`	No heartbeat or ping interval.
`WS-009`	Plaintext `ws://` URL in source.
`WS-010`	Cross-tenant broadcast with `io.emit(...)`.

Object-level and function-level authorization (OWASP API1 and API5) apply here as they do to REST handlers. See OWASP API Top 10.