Private information exposed through GraphQL filters

**Summary:** secure schema can be circumvented for graphql `where` filters by using `or` operator.

query {
  teams(where:{_or:[{state:{_eq:soft_launched}}, {state:{_eq:soft_launched}}]}) {
    edges {
      node {
        id
        state
      }
    }
  }
}