Should Keystone enforce GraphQL query depth limits by default?

Context

Multiple independent security researchers (myself and @nedlir) have independently identified that Keystone's GraphQL API has no query depth limiting, complexity analysis, or cost budgeting.

A single unauthenticated request with a deeply-nested circular relationship query (e.g. users → posts → author → posts → author → ...) triggers exponential database queries. In local testing against a SQLite database with 6 total records, a depth-16 query caused a 38-second server hang.

This is classified as CWE-400: Uncontrolled Resource Consumption.

What other GraphQL frameworks do

Reproduction

Any Keystone project with bidirectional relationships (the standard pattern):

# No authentication required (with allowAll access)
{
  users {
    posts {
      author {
        posts {
          author {
            posts {
              author {
                posts {
                  author { id }
                }
              }
            }
          }
        }
      }
    }
  }
}

Measured response times (SQLite, 1 user + 5 posts + 15 comments):

Proposal

Add a default query depth limit (e.g. 10) using graphql-depth-limit or equivalent, with a configuration option:

export default config({
  graphql: {
    maxDepth: 10, // default, configurable
  },
})

Questions

1. Should Keystone ship with a default query depth limit?
2. Should this be treated as a security advisory or a hardening improvement?
3. What default depth limit would be appropriate?

cc @nedlir @dcousens