As far as I can tell, the original report doesn't actually say whether there's no Cache-Control header at all or whether it set to max-age=0. I would still arg

As far as I can tell, the original report doesn't actually say whether there's no Cache-Control header at all or whether it set to max-age=0. I would still argue that caching a POST response with max-age=0 (and no max-stale) is a bug because, while the standard technically allows it, it also technically allows the client to immediately invalidate it and immediately invalidating is the saner choice (at least, it's the choice that is going to break fewer websites).