Welcome to episode 363 of The Cloud Pod, where the weather is always cloudy! Justin, Matt, and Ryan are in the studio this week to bring you all the latest in cloud and AI news, including Amazon SQS turning 20, Grok solving a Rubik’s cube, and Cloudflare’s new “spot the bot” tool, which harnesses *checks notes* monitoring mouse movements? Ok… It’s been a busy week in the cloud, so let’s get started!
Titles we almost went with this week
- AI Speed Dating: Grok Wins, Cube Loses
- Grok, GPT, and Claude Walk Into a Rubik’s Cube
- One Gateway to Rule All the Claude Credentials
- AWS Puts a Bouncer on the Claude Code Party
- Claude Solves the Cube, GPT Just Sees Dark Faces
- Cloudflare Catches Bots by Their Shaky Hands
- GuardDuty Sniffs Out Bedrock Bandits at Last
A big thanks to this week’s sponsors:
We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.
General News
01:36 Former GitHub CEO Unveils Distributed Git Network Built for AI Coding Agents
- Former GitHub.com CEO Thomas Dohmke has launched Entire, a startup building a distributed Git network aimed at reducing load on centralized hosting caused by AI coding agents.
- The company raised a $60 million seed round at a $300 million valuation.
- The core idea is to mirror GitHub repos across regions (US, Europe, and Australia currently) so AI agents pull from nearby mirrors instead of hitting a single central repo, which addresses rate-limiting and latency issues that come with high-volume automated cloning and pushing.
- Reported internal benchmarks include about 570,000 clones per hour on a single repo and 586 pushes per second, though these are self-reported and not yet independently verified; Entire says it plans to open source the Git backend and benchmarking tools for third-party validation.
- Beyond distribution, Entire is building a semantic layer on top of Git history, capturing agent prompts, reasoning, and tool calls, with features like Entire Blame tracing AI-generated code back to originating prompts, and Entire Review supporting multi-agent code review.
- Worth discussing: this treats AI agent traffic as a distinct infrastructure problem separate from human developer workflows, and the long-term roadmap includes data sovereignty features letting companies keep code within specific regions while staying connected to a global network.
03:31 Justin – “Get fired for having all these issues, and then solve the problem anyway.
06:03 Satya Nadella on X: “https://t.co/xv6csf1SbV”
- The problem: Microsoft CEO Satya Nadella coined the “Reverse Information Paradox”: AI flips Kenneth Arrow’s classic info paradox. Instead of sellers giving away value before being paid, buyers now have to feed proprietary knowledge into a model just to make it useful, paying twice: once in dollars, once in IP.
- The mechanism: Nadella says every prompt, correction, and eval is “exhaust” that trains the model provider’s future intelligence, a one-way flow where the vendor learns about your business, and you learn nothing about their model.
- The stakes: Without a fix, economic value drifts to whoever owns the learning infrastructure (the model providers), not the companies actually generating the knowledge. He quotes Palantir’s Alex Karp on customers wanting to own their compute, models, data, and alpha, not quietly hand it over.
- The ask: Nadella says enterprises need a hard trust boundary, a line across which nothing (not even usage exhaust) crosses without consent, so data, traces, evals, and tuned weights stay owned by the firm.
- His 5 C’s framework: Control your own evals/traces/feedback, build in-tenant Capability to tune models, keep Choice by decoupling orchestration from any single model, use that decoupling to manage Cost, and Compound it into a continuous learning loop.
- The bottom line: Nadella’s take, using a model shouldn’t require giving up the knowledge that makes your company unique.
07:26 Justin – “I get what he’s saying, but I also, you are selling one of the largest LM models that’s literally sucking up all this knowledge and doing exactly what you just complained about. So what’s your solution, Satya? That’s what I want to know.”
AI Is Going Great – or How ML Makes Money
10:59 We made Grok 4.5, GPT-5.5, and Claude build the same apps
- TryAI’s build-off tested Grok 4.5, GPT-5.5, Claude Opus 4.8, and Claude Fable 5 on identical one-shot prompts to build a 3D Rubik’s Cube, particle gravity sandbox, and Breakout game as self-contained HTML files, then measured latency and cost through a unified test harness.
- Grok 4.5 differentiated on performance metrics: sub-half-second time to first token, roughly 110 tokens/second throughput (about double the other models), and the lowest cost per reply, though it required one retry to render the Rubik’s Cube correctly on the hardest task.
- Claude Opus 4.8 and Fable 5 were the only models to successfully render the 3D Rubik’s Cube with correct colors and animated solving on the first attempt, positioning them as the more reliable choice for complex, stateful coding tasks at the cost of higher latency and price.
- GPT-5.5 produced the most visually appealing particle gravity sandbox and had the fastest response times on short answers, but failed to render a complete Rubik’s Cube, showing only a single dark face.
- All four models successfully built a playable Breakout game on the first try with score tracking and lives, indicating that for moderately complex, well-established app patterns, model choice may matter less than for novel or highly stateful tasks like 3D cube logic.
12:29 Ryan – “…this is one of those things I think that when you’re using multiple models in your development or playing around, you always have this thought: it’d be interesting to see what, given the same problem, and see what the differences are. And so it’s nice to see that someone actually did it.”
15:48 Redesigning Claude Code on desktop for parallel agents
- Anthropic redesigned the Claude Code desktop app to support running multiple agentic coding sessions in parallel, with a new sidebar for managing active and recent sessions across repos, filterable by status, project, or environment.
- The update adds an integrated terminal, file editor, and diff viewer directly in the app, with a drag-and-drop pane layout so developers can review and ship Claude’s work without switching to a separate editor.
- A new side chat feature (Cmd/Ctrl + semicolon) lets users branch off questions mid-task without polluting the main session thread, useful for steering or clarifying without derailing the primary agent run.
- SSH support now extends to Mac in addition to Linux, allowing sessions to run locally or against remote machines from either platform, and the app has plugin parity with the CLI for centrally managed or locally installed plugins.
- Three view modes (Verbose, Normal, Summary) let users control how much detail they see from Claude’s tool calls, and the app now streams responses in real time with a usage indicator showing context window and session consumption; available now for Pro, Max, Team, Enterprise, and API users.
AWS
20:50 Introducing Claude apps gateway for AWS
- AWS and Anthropic launched Claude apps gateway, a self-hosted control plane for managing Claude Code and Claude Desktop deployments across development teams, addressing the operational overhead of provisioning individual credentials and manually tracking spend per developer.
- The gateway centralizes five functions: identity via OIDC/SSO integration, policy enforcement (model access, tool permissions), telemetry via OTLP to CloudWatch or Prometheus, request routing to Bedrock or Claude Platform on AWS, and configurable spend caps at the org, group, or user level.
- Deployment runs as a stateless container on ECS, EKS, or EC2, backed by RDS for PostgreSQL for session state, with no long-lived secrets on developer machines; sessions expire automatically when a user is removed from the identity provider, typically within one hour.
- Organizations choose between two routing options: Amazon Bedrock keeps data within the AWS security boundary using existing IAM roles, while Claude Platform on AWS offers Anthropic’s native platform experience with AWS authentication and billing, giving flexibility depending on data residency requirements.
- This addresses a real governance gap for enterprises scaling AI coding assistants; spend caps and centralized policy control let admins restrict models, tool permissions, and file/network access without pushing configuration changes to each developer’s machine individually.
22:04 Ryan – “Hey Anthropic, maybe this should just be in your product? Ever thought of that?”
24:22 AWS Builder Center Now Offers Free Sandbox Environments:
- AWS Builder Center now offers free, time-limited sandbox environments for eligible workshops, removing the barrier of needing a personal AWS account or credit card to experiment with AWS services.
- Each sandbox provides 8 hours of pre-provisioned access with automatic resource cleanup afterward, and builders can request one sandbox per week, with the limit resetting every Sunday.
- Provisioning takes roughly 15 minutes, making it practical for quick hands-on learning sessions or workshop completion without upfront setup time.
- This lowers the entry barrier for AWS skill-building, particularly useful for students, bootcamp participants, or anyone hesitant to link a credit card just to try out a tutorial.
- Availability is currently limited to select workshops at launch, with AWS planning to expand sandbox support to additional workshops over time; details at builder.aws.com/workshops.
25:09 Ryan – “It’s only what, a decade after GoogleBot Quick Labs that they’re bringing this back? A little behind on this one.”
26:59 OAuth support for the AWS MCP Server
- AWS MCP Server now supports OAuth, letting AI agents authenticate using AWS Sign-In instead of requiring separate authentication software or credential management layers.
- Existing IAM permissions, identities, and governance controls carry over automatically, so this is an additive security layer rather than a replacement for current access management setups.
- Both interactive (browser-based) and headless (non-interactive) authorization flows are supported, covering use cases from developer testing to automated agent deployments in production pipelines.
- New administrative controls include OAuth-specific IAM condition keys, token introspection and revocation APIs, dynamic client registration, and CloudTrail audit logging for tracking agent access.
- This matters for teams building AI agents that need to interact with AWS resources, as it standardizes authentication using OAuth rather than proprietary or ad hoc token schemes, easing integration with third-party agent frameworks.
30:49 Building secure AI agents at scale: Introducing Loom for AWS
- AWS Labs released Loom, an open source, enterprise-grade platform for building and deploying AI agents using Strands Agents SDK and Amazon Bedrock AgentCore Runtime, addressing the gap between raw agentic building blocks and production-ready governance frameworks.
- Loom tackles seven specific enterprise pain points, including automated resource tagging, role and attribute-based access control, identity propagation through delegated agent chains using RFC 8693 token exchange, and human-in-the-loop approval before sensitive actions are taken.
- The platform offers both low-code deployment with a pre-written, customizable Strands agent and no-code deployment via AgentCore’s managed harness, letting platform teams scan code once and reuse it across deployments rather than generating and validating new code each time.
- Loom integrates with AWS Agent Registry (currently in public preview) for agent and tool discovery, complying with the A2A agent card spec and MCP tool schema spec, which helps organizations manage sprawl as agent, tool, and skill counts grow.
- This is a free, open source project available now at github.com/awslabs/loom, positioned as a reference implementation rather than a managed AWS service, so customers deploy and operate it themselves on their own AWS accounts with standard Bedrock and AgentCore usage costs applying.
31:54 Justin – “This is when Amazon gives you a sort of nice thing, but batteries not included.”
33:50 Amazon SQS turns 20: Two decades of reliable messaging at scale
- Amazon SQS launched July 13, 2006, as one of AWS’s first three services alongside EC2 and S3, and the core function of decoupling producers from consumers remains unchanged 20 years later.
- FIFO high throughput mode scaled substantially over the years: from 3,000 TPS at launch in 2021 to 70,000 TPS per API action in select regions by late 2023, addressing customers with demanding ordered-messaging workloads.
- Security defaults improved with SSE-SQS encryption becoming the default for all new queues in October 2022, removing the need for customers to manually configure encryption or manage keys.
- Payload size increased from 256 KiB to 1 MiB in August 2025 for both standard and FIFO queues, reducing the need for customers to offload larger messages to S3, with corresponding updates to Lambda event source mapping.
- Fair queues, introduced in July 2025, address the noisy neighbor problem in multi-tenant standard queues by using message group IDs to prevent one tenant from delaying delivery for others, requiring no consumer-side changes.
- SQS has extended into AI workloads, with customers using queues to buffer LLM requests, manage inference throughput, and coordinate communication between autonomous AI agents, as detailed in AWS’s asynchronous AI agents architecture using Amazon Bedrock.
35:16 Ryan – “I love SQS. It’s one of those foundational services that, when in Amazon, I use in every application seemingly that I design just because it’s so easy to sort of build either a state machine off of Lambda or some containerized event-based coordination across multiple components. Great. I love this.”
40:51 AWS Security Hub now provides AI inventory for organization-wide visibility of AI assets
- Security Hub now auto-discovers and catalogs AI assets across an organization using three methods: AWS Config data for managed services like Bedrock and SageMaker, enhanced Inspector SBOM analysis for self-hosted models on EC2 and ECR (covering Ollama, vLLM, Hugging Face TGI), and GuardDuty DNS telemetry to spot calls to third-party AI APIs.
- The core problem this addresses is shadow AI: security teams often don’t know what models, agents, or inference endpoints are running across their accounts, making it impossible to assess risk or respond to threats tied to those workloads.
- Discovered assets are correlated with existing GuardDuty findings and other security stack signals, letting teams filter and prioritize by account, resource type, discovery method, or model identity to focus remediation on the highest-risk AI workloads.
- The feature is bundled into Security Hub Essentials at no extra cost and requires no additional setup, available across all AWS commercial regions where Security Hub already operates, making adoption low-friction for existing customers.
- This reflects a broader trend of cloud security tooling extending to cover AI-specific risks, as organizations increasingly need visibility into both first-party model deployments and third-party API dependencies that fall outside traditional infrastructure monitoring.
44:24 Introducing Amazon GuardDuty AI Protection for AWS AI workloads
- GuardDuty AI Protection extends AWS threat detection to Bedrock and SageMaker, addressing a visibility gap as organizations deploy more AI workloads without dedicated security tooling.
- The service targets AI-specific threats including cost harvesting attacks (excessive GPU and token consumption), anomalous model invocation patterns, and prompt injection attempts, the latter via integration with Bedrock Guardrails.
- Detection relies on analyzing CloudTrail management and data events, requiring no manual configuration or custom tooling, and can be enabled organization-wide through AWS Organizations for centralized management.
- Findings integrate directly with AWS Security Hub, giving security teams a consolidated view of AI assets alongside other cloud threat data rather than a separate console to monitor.
- A 30-day free trial is available for existing GuardDuty customers; pricing details are on the GuardDuty pricing page (aws.amazon.com/guardduty/pricing), with costs likely tied to event volume similar to other GuardDuty protection plans.
45:09 Ryan – “I always laugh that they have to – in every single blog post – they have to explain the difference between Security Hub and Guard Duty because it’s sort of like the same thing. But you know, it’s just what Amazon does. They have Guard Duty for the detections, and they have config, and they have all these different things that feed into Security Hub as your sim kind of, you know, so it’s sort of funny.”
GCP
49:07 New ways to keep Google Cloud certs current
- Google Cloud is replacing the mandatory two-year proctored exam recertification model with an option to use Google Skills courses and skill badges instead, applying initially to Cloud Digital Leader, Associate Cloud Engineer, Professional Cloud Architect, and Professional Data Engineer certifications.
- Completing required courses or skill badges while a certification is still active automatically extends it by one year, giving certification holders a flexible, self-paced alternative to exam-based renewal.
- Skill badges are positioned as the faster path since they focus on hands-on labs tied to real-world tasks, while courses are aimed at those wanting deeper conceptual review of updated material.
- Google cites Harvard Business Review data showing skill half-life has dropped from roughly six years to 2.5 years, framing this as the rationale for more frequent, lower-friction recertification.
- The change reflects a broader industry shift toward continuous, practical validation of cloud skills rather than one-time exam certification, which could influence how other cloud providers structure their own certification renewal programs.
53:48 Google Cloud Run sandboxes are in public preview
- Cloud Run sandboxes are now in public preview, giving developers an isolated runtime to execute untrusted or AI-generated code without exposing host applications, data, or cloud credentials.
- Startup latency averages 500ms, with the example in the announcement showing 1,000 sandboxes started, executed, and stopped.
- Security defaults are locked down: sandboxes have no access to environment variables or the metadata server, network egress is blocked by default unless explicitly enabled, and the filesystem is read-only with changes written to a temporary memory overlay that’s discarded after execution.
- Key use cases include LLM code interpreters for data analysis, headless browsers for web scraping and automation, and running user-submitted scripts or plugins on multi-tenant platforms.
- Enabling the feature requires adding a single flag during deployment via gcloud or YAML config, and sandboxes are invoked through a CLI binary using standard subprocess calls, which keeps the developer workflow simple.
- Integration is built into the next version of Agent Development Kit via a CloudRunSandboxCodeExecutor, and support has also been added to ComputeSDK, a vendor-agnostic sandbox SDK, for use inside or outside the Cloud Run service.
- Sandboxes run on the CPU and memory already allocated to the Cloud Run instance, so there is no additional charge or premium for the feature compared to dedicated sandbox hosting platforms that bill for on-demand VMs.
55:00 Ryan – “This is crazy cool. I love this. If you have an agent execution inside your own cloud container, it has access to everything. And it’s so easy to do prompt injection, you know, and if you don’t catch that in your application, the user on the other side of that application using the app could just get all of that system information directly. And so this is a way to sort of secure against that, which is fantastic.”
55:54 Introducing k8s-aibom on GKE for automated AI bills of materials
- Google open-sourced k8s-aibom, an unprivileged Kubernetes controller for GKE that automatically detects running AI runtimes (vLLM, Triton, TGI, Ollama, LangChain, etc.) and generates standardized CycloneDX 1.6 ML-BOMs without requiring sidecars, eBPF modules, or pod spec changes. GitHub repo available at github.com/GoogleCloudPlatform/k8s-aibom.
- The tool addresses shadow AI detection by monitoring live cluster state (KServe resources, Deployments, StatefulSets, Jobs) rather than scanning artifacts at build time, catching workloads that were never formally registered with security teams.
- A three-tier Confidence Model classifies findings as Declared (explicit config), Inferred (pattern-matched from container signatures), or Unresolved (AI presence detected but unverifiable), giving auditors a way to distinguish human intent from automated inference.
- Output is deterministic (identical cluster state produces byte-identical BOMs), supporting GitOps diffing and drift alerts, and Cloud Storage sink writes use DoesNotExist preconditions to make BOM records immutable once created, targeting audit-grade evidence requirements.
- Maps directly to compliance frameworks including EU AI Act Articles 12 and 50, NIST AI RMF, and ISO/IEC 42001, positioning it as a governance tool for CISOs and compliance teams working with GKE-hosted AI workloads rather than a replacement for existing posture-management tools.
57:09 Ryan – “I look forward to having to roll this out immediately to address shadow AI.”
Azure
58:54 Azure Monitor Observability Agent goes autonomous (preview)
- Azure Monitor Observability Agent has reached general availability, and Microsoft is now adding autonomous operations capabilities in public preview, allowing the agent to take independent action based on monitoring data rather than just surfacing insights.
- The autonomous mode builds on the existing Copilot integration within Azure Monitor, positioning it as part of Microsoft’s broader push to embed AI-driven automation across its observability and IT operations tooling.
- Target use cases center on reducing manual intervention for common operational tasks, such as anomaly detection and remediation workflows, which could appeal to teams managing large or complex Azure environments.
- As a preview feature, specific pricing details were not outlined in the announcement, so listeners should check the Azure Monitor pricing page for current cost structures once autonomous capabilities move toward general availability.
- Worth discussing on the show is how much operational trust teams will place in an agent that acts autonomously versus one that only recommends actions, and what guardrails Microsoft has built in for this preview.
1:01:07 Accelerate modern Linux workloads with Azure Files
- Azure Files NFS targets Linux workloads with new performance features including nconnect for multiple parallel TCP connections, zonal placement to co-locate shares with GPU VMs, and a provisioned v2 billing model that lets teams size IOPS and throughput independently.
- For AI inferencing, storing model weights on a shared file share instead of embedding them in container images lets multiple replicas mount and read the same data simultaneously, cutting cold start times and reducing GPU idle time during scaling.
- Kubernetes integration via the Azure Files CSI driver supports ReadWriteMany access for AKS workloads, with the new file share experience supporting up to 10,000 shares per subscription per region and provisioning about 2.5 times faster than before.
- Enterprise migration tools like Azure Storage Mover and Azure Migrate support for NFS, plus third-party options like Komprise, help move POSIX-compliant Linux applications such as SAP to Azure without requiring refactoring; Medline’s SAP migration saw transaction times improve by more than 80 percent.
- Standard protocol support (SMB 3.x and NFS 4.1) means partners and ISVs can build on Azure Files without proprietary integration work, supporting use cases like database backups, BCDR solutions, and GitHub Actions workflows on AKS for caching and artifact storage.
1:02:01 Justin – “I really, really had hope that we were we were on this trajectory that would end up with there, you know, being no SIFs or NFS file shares ever again, like or necessary, and now it’s all coming back with like such a vengeance. It’s so crazy, ’cause it’s like we were so close to everything’s gonna be optic storage, and now AI screwed it all up for everybody.”
1:03:24 Tokenomics | The new AI currency & your options explained
- Microsoft’s Tokenomics guidance frames tokens as the core cost unit for AI applications, and app design choices directly affect consumption rates and spend.
- Key optimization techniques highlighted include compressing conversation history rather than resending full context on each call, and setting caps on token usage to control costs.
- This matters for Azure OpenAI Service customers building conversational AI apps, since inefficient prompt and context management can significantly inflate token consumption and billing.
- The guidance applies broadly to teams using Azure AI Foundry or Azure OpenAI Service, and points to practical architectural patterns developers can adopt now to manage costs as usage scales.
- Pricing for token consumption varies by model and Azure OpenAI Service tier, so listeners should check current Azure OpenAI pricing pages for per-token rates relevant to their chosen models.
1:03:57 Justin – “Also, a big thing that impacts your token costs – caching.”
Emerging Clouds
1:06:42 Improving Smart Tiered Cache for Public Cloud Regions
- Cloudflare’s Smart Tiered Cache previously couldn’t optimize caching for origins behind anycast or regional unicast IPs, which is common for AWS, GCP, Azure, and Oracle Cloud deployments, since a single origin IP can appear equidistant from many Cloudflare data centers, preventing selection of one best upper tier.
- The fix lets customers manually supply a cloud region hint, such as aws:us-east-1, so Cloudflare can map the origin to its actual region and assign an optimal primary and fallback upper tier, rather than falling back to a less efficient multi-tier topology.
- Cloudflare detects anycast origins using a speed of light constraint on probe latencies from multiple checkpoint data centers; if two measured latencies are physically faster than fiber could allow between locations, the origin is flagged as anycast.
- Without this fix, hairpin routing could occur; for example, an origin in Singapore might get assigned an upper tier in Chicago, adding hundreds of milliseconds of latency from unnecessary cross-continental round trips.
- The feature is configurable via dashboard, API, or Terraform, and is available now for AWS, GCP, Azure, and Oracle Cloud, with additional provider support planned. This is relevant for any team running cloud-hosted origins behind load balancers who wants better cache hit ratios without re-architecting their setup.
1:07:47 Ryan – “This is neat, like if you’re running a globally distributed app, this has always been sort of an issue. Like trying to manage your multi-regions and your availability and blue-green deployments even.”
1:08:40 Introducing Precursor: detecting agentic behavior with continuous client-side signals
- Cloudflare launched Precursor, a client-side session-based bot detection system that continuously monitors behavioral signals like mouse movement, keyboard rhythm, and focus changes throughout an entire user session, not just at login or checkout.
- This extends existing protections from Turnstile, which runs about 3 billion times daily but only covers specific checkpoints, closing a visibility gap for the rest of the user journey where bots can otherwise blend in.
- The technical approach relies on physical constraints that are difficult for bots to fake consistently over time, such as wrist pivot arcs, cognitive load delays, and hand tremor frequency, versus the linear paths and mathematically precise timing typical of automation scripts.
- Session-scoping is a key design choice: behavioral data persists across a session so bots cannot reset their signature by refreshing the page or retriggering a challenge, raising the operational cost and complexity for bot developers who must now simulate an entire session rather than a single interaction.
- Privacy is addressed by collecting only aggregate behavioral patterns (e.g., typing rhythm, not actual keystrokes) that aren’t tied to user accounts or exposed in dashboards, and the feature includes new session-based views in Security Analytics for visibility into full visitor journeys rather than individual requests.
- Precursor is available now as an Enterprise Bot Management feature, free until general availability later this year, and can be enabled with no application changes required.
1:09:36 Justin – “If you are a CloudPod host, and you add this to your thing and you break our bot, I’m just gonna stop covering you.”
After Show
1:08:40 RFC 10008: The HTTP QUERY Method | RFC Editor
- The IETF has finalized RFC 10008, formally standardizing the HTTP QUERY method after years of discussion dating back to a 2019 HTTP Workshop proposal, giving developers a new option beyond GET and POST for read-only operations.
- QUERY solves a practical problem: sending complex search or filter parameters that are too large or awkward for a URL, while still keeping the safe and idempotent properties that GET offers, meaning requests can be cached, retried, or automated without side effects.
- Unlike POST, which is often misused for queries because it can carry larger payloads, QUERY explicitly signals to clients, caches, and intermediaries that the request will not change server state, enabling proper caching behavior and automatic retry logic.
- The spec includes the new Accept-Query response header, letting servers advertise which query formats they support, such as SQL, JSONPath, or XSLT, giving clients a standard way to discover capabilities before sending a request.
- Adoption will require work on both server and client sides, including handling CORS preflight requests since QUERY is not in the CORS safelist, and cloud API designers will need to decide whether to expose QUERY alongside or instead of existing search endpoints built on POST.
- https://mockoon.com/articles/list-http-request-methods/
