GraphQL — Introspection Reveals Hidden Fields

GraphqlAPI exposes a single /graphql endpoint with introspection enabled. Use introspection to discover an undocumented query field that returns admin secrets, then call it.