GraphQL: server has no query depth limit
About A04:2021 — Insecure Design
Insecure design captures architectural problems that can't be fixed with a one-line patch — missing rate limits, business logic that allows abuse. This category is new in the 2021 list.
Impact: Missing rate limits on a login endpoint means credential stuffing works. Missing rate limits on a password reset means SMS bombing. Missing rate limits on a paid API endpoint means a $5,000 bill from one bad actor. Most of these don't look like 'security bugs' until you're in incident response.
How to fix it: Build rate limiting in from day one (per IP, per user, per endpoint). Think about the threat model: who can call this, how often, and what happens if they call it 1000x more than expected?
Common patterns in this category:
- No rate limiting on authentication endpoints
- Password reset emails sent without throttling
- API endpoints with no per-user request budget
- Business logic that can be replayed indefinitely (e.g. coupon application, vote casting)
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC204 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.