Zend certified PHP/Magento developer

Venia pwa + magento 2

Can anyone explain how security works on graphql on venia pwa? I don’t see any tokens or sessions or something like this at Venia. So any developer can create a graphql query and get all data from my site?