What is a common mistake when working with GraphQL security?

A common mistake with GraphQL security is protecting only the single GraphQL endpoint while assuming every field is equally authorized can expose data through nested resolvers. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.