Confidential data of users and limited metadata of programs and reports accessible via GraphQL

**Summary:** The GraphQL endpoint doesn't have access controls implemented properly.

{
  id
  users()
  {
    total_count 
    nodes
    {
      _id
      name
      username
      email
      account_recovery_phone_number
      account_recovery_unverified_phone_number
      bounties
      {
        total_amount
      }
      otp_backup_codes
      i_can_update_username …