How GraphQL Mutation Aliasing Led to a $12,500 DoS Bug in HackerOne’s Account Recovery Flow

A small GraphQL behavior created a very real availability problem.