GraphQL API vulnerabilities