A common security measure for GraphQL APIs is to block use of introspection in production.