GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled (which is the default configuration) by naming your query/fragment __schema.