Reviews a GraphQL server or gateway before it ships: the schema, resolvers, context builder, limits, subscriptions, and federation setup. Paste the schema, the server configuration, and the resolvers to find relations nested with no depth or cost limit, list fields with no maximum page size, mutations repeated under aliases or batched past the rate limiter, introspection and field suggestions open in production, stack traces in errors, checks a node or relation path skips, and subgraphs reachable without the gateway. Returns a verdict, a map of every entry point and limit, evidence-linked findings, the smallest fix in the supplied server, and queries that prove it. Written for backend developers who run Apollo, Yoga, graphql-java, Strawberry, Hasura, or a federated supergraph. States the defaults and configuration it does not see instead of inventing them.