A production GraphQL API should authenticate users appropriately and enforce authorization on the server.

Also consider query depth limits, query complexity limits, pagination bounds, rate limiting, input validation, sensitive error handling, secure secret management, audit logging, and appropriate introspection policies.

Security should be layered. No single control should be expected to protect the entire API.