Avoid shipping GraphQL dev landing or playground plugins without a production guard

#Metadata

Rule ID

ts.security.apollo-server-graphql-dev-tooling-exposure

Severity

medium

Confidence

0.78

Languages

javascript, typescript

Presets

recommended, security, strict

Stability

experimental

Applies to

block

Tags

apollo, graphql, rules-catalog, security

#Why it matters

Interactive GraphQL explorers widen attack surface and often expose schema details beyond what production APIs should advertise by default.

#Remediation

Load sandbox or local landing plugins only outside production, prefer `ApolloServerPluginLandingPageProductionDefault`, or disable interactive explorers behind authentication at the edge.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.apollo-server-graphql-dev-tooling-exposure.rule.yaml.