How do you secure a GraphQL API against malicious or overly complex queries?

Use Depth Limiting, Query Complexity Analysis, and Timeouts.

Because GraphQL schemas are graphs, an attacker can write a recursive query (e.g., user -> posts -> author -> posts -> author) that grows exponentially and crashes the server (Denial of Service). Depth limiting blocks queries exceeding a certain depth. Complexity analysis assigns a 'cost' to each field and rejects queries exceeding a maximum cost threshold.