The MaskErrors extension does not seem to mask validation errors. This is because the .on_operation() handler only looks at self.execution_context.result.errors while validation errors (such as misspelled field names, which is how I stumbled upon this) are in self.execution_context.errors.

I have subclassed MaskErrors in my project and added a .on_validate() handler that does the following:

def on_validate(self) -> Iterator[None]:
    if self.execution_context.errors:
        processed_errors: List[GraphQLError] = []
        for error in self.execution_context.errors:
            if self.should_mask_error(error):
                processed_errors.append(self.anonymise_error(error))
            else:
                processed_errors.append(error)

        self.execution_context.errors = processed_errors
    yield

This will correctly mask such validation errors as well.

Since I'm not very familiar with the internals of this project it was not immediately obvious how to write a test for this, since the existing tests in test_mask_errors.py all look at execution results. With some pointers on that, I could turn this ticket into a PR.