mirror of
https://github.com/lukaszraczylo/graphql-monitoring-proxy.git
synced 2026-10-11 05:27:47 +00:00
An audit against the code found stale defaults, wrong numbers, an invented error-response example, and capability claims for features that do not exist (query-complexity limiting, IP-based and per-endpoint rate limits, config hot-reload). Correct the env-var defaults, the degraded-retry and keepalive numbers, and the circuit-open response example. Reframe the cache-key isolation as a correctness boundary, not an authentication one, because the proxy does not verify JWT signatures. Document the admin dashboard exposure, the API key scope, the WebSocket ban and rate-limit checks, and the new BIND_ADDRESS option.