After detecting a suspect anonymous SELECT, the auditor sends an actual anonymous GraphQL query against /v1/graphql and reports CONFIRMED with the row …
Built a security auditor for Hasura — finds anonymous role with open SELECT, user role … – Reddit