GraphQL Introspection Is Still Wide Open Across the S&P 500

We scanned every GraphQL endpoint we could find across 541 S&P 500 companies. 37 have introspection enabled — including nine industrial, financial, and utility names with zero bug-bounty coverage on the exposed asset.

NullBlocks Research — August 2026

GraphQL introspection has been "the thing everyone knows to disable" for years — it's in every API security checklist, every OWASP GraphQL cheat sheet, every pentest report template. It hands an attacker (or a researcher) the entire schema for free: every type, every field, every mutation, with zero guessing required. And yet, scanning the same 541 S&P 500 companies behind our bug bounty coverage gap report, we found 37 companies running at least one publicly reachable GraphQL endpoint with introspection still turned on.

Methodology, up front

domrecon probes every discovered subdomain for a live GraphQL endpoint (the standard /graphql, /api/graphql, and common variants) and, where one responds, sends a standard introspection query (__schema { types { name } }). If the server answers instead of rejecting the query, we record the endpoint, how many types and mutations the schema exposes, and flag severity based on mutation count (a schema that only exposes read queries is a smaller problem than one that hands back a live mutation list). This pass covers 280,211 scanned subdomains across the index — 109 GraphQL endpoints found, 109 responded to introspection.

1. 37 of 541 companies (6.8%) expose a GraphQL schema via introspection

That's every company with at least one endpoint that answered the introspection query. Of those, 24 companies (65% of the exposed group) have at least one endpoint we flagged HIGH severity — meaning the schema didn't just expose read queries, it handed back a live mutation list (create/update/delete operations, in whatever the schema names them). Across just the HIGH-severity endpoints alone: 61 endpoints, 2,561 total exposed mutations, 22,970 total exposed types.

The heaviest single exposures by mutation count:

To be clear about what this does and doesn't mean: an exposed mutation name in a schema is not automatically an exploitable vulnerability — most of these are almost certainly gated by auth checks server-side, and many of the flagged hosts are marketing/brand microsites (brand.uber.com, brandbank.wm.com) rather than core product APIs. But introspection being open at all removes the attacker's first and hardest step: figuring out what's there to even try. A schema handed to you on request is a different starting position than one you have to fuzz blind.

2. Sector spread: this isn't concentrated in tech

Information Technology has the most exposed companies (10), which isn't surprising. What's more interesting is the tail: Industrials (5), Consumer Discretionary (7), Utilities (3), Real Estate (3), and Financials (2) all have at least one company running an introspectable GraphQL endpoint. This is infrastructure/vendor tooling (marketing platforms, brand-asset CMSes, workflow tools) leaking through on subdomains that aren't anyone's primary focus during a security review — exactly the kind of asset that gets scanned once at launch and never revisited.

3. The overlap: 22 of 24 high-severity-exposed companies have zero HackerOne coverage

Cross-referencing this dataset against the same HackerOne scope-matching data from our last report: of the 24 companies with a HIGH-severity GraphQL exposure, only 2 have any matched HackerOne bounty program at all. The other 22 — including Honeywell, Ford, IBM, Workday, Cboe Global Markets, Waste Management, Alliant Energy, and Carnival Corporation — have a live, introspectable, mutation-exposing GraphQL endpoint and nowhere on HackerOne to report what a researcher finds there.

This is the same structural gap our bounty-coverage report already surfaced (2.8% overall H1 coverage across the index), showing up again in a completely different exposure class. It's not a coincidence specific to subdomain takeovers — it's the general shape of this dataset: real, concrete technical exposure exists broadly across the S&P 500, and disclosure infrastructure exists narrowly, concentrated in a small cluster of companies that already had mature security programs before any of this scanning happened.

What this means if you hunt bug bounties

1. Don't skip the marketing/brand subdomains. The heaviest GraphQL exposures in this dataset sit on hosts like brand.honeywell.com and brandbank.wm.com — not the primary corporate domain. If a company's core API is locked down, its vendor-run brand-asset or workflow subdomains are worth a separate look.
2. A large exposed schema is a map, not a finding by itself — the value is in what it tells you to try next (which mutations exist, what fields they take), not in the introspection response itself.
3. Check for a disclosure path before you dig in. As with the subdomain-takeover overlap in our last report, most of the companies here have no H1 program — check security.txt and Bugcrowd before assuming there's nowhere to send a real finding.
4. This is a point-in-time snapshot, not continuous monitoring — introspection can be (and sometimes is) toggled off after a report, then quietly re-enabled during the next deploy. Worth rechecking a target periodically, not just once.

Check your own footprint

Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, version-matched CVEs, full technology stack, GraphQL endpoint detection, and live subdomain inventory. No signup required.

If you want the aggregate, cross-company view instead of one domain at a time — the kind of query that produced this report — that's what we built next: Graph Explorer, continuous scanning of the S&P 500's public attack surface as one interactive graph. See what's in it →

Data as of 2026-08-17, one point-in-time snapshot from our GraphQL introspection probe and nightly HackerOne sync — not continuous monitoring. Spot an error, or want the underlying query for a specific company? Reply — we read every message.

NullBlocks Systems — domrecon attack-surface intelligence.