Facebook handles malicious queries by setting a list of permitted queries. I want to get this implemented soon at the server layer, check out my PR here: <a href="https:&#x2F;&#x2F;github.com&#x2F;graphql&#x2F;express-graphql&#x2F;pull&#x2F;77" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;graphql&#x2F;express-graphql&#x2F;pull&#x2F;77</a>