would be curious to see what people think of the issues and how they might apply to Lacinia?
Most of them only apply to public api's. https://www.apollographql.com/blog/graphql/security/9-ways-to-secure-your-graphql-api-security-checklist/ is a more positive minded post about the same.
fair point. I find the query “complexity” limit a useful one in general. I wonder if there’s an example of this for Lacinia somewhere?