When GraphQL Directives Become Weapons: The Unauthenticated Project Deletion Path | Vulnox Blog