Christoph Benjamin Weber

wouldn't it be nicer if an [OAuth app](https://developer.github.com/apps/building-integrations/setting-up-and-registering-oauth-apps/) would be set up? Then users wouldn't have to generate acces tokens and wonder over necessary scope settings at all.

Yes, that sounds good. A PR would be appreciated for sure.

I'd second this. You could easily imagine malicious queries taking down APIs powered by Hasura. For example, running the following query against the [todo learning API](https://learn.hasura.io/graphql/graphiql) takes some time, and...

That's good to hear, haven't seen that before. But there are uses cases which query whitelisting doesn't fulfill (having a public facing API with unknown clients). Guess I hope other...

Would be useful for sure. But these updates make nice PRs for starters/people new to the project☺ Also, some of the implementations don't have tests on their one. That would...