Qodri Muhammad and Qrocketlab: A Fair Review of the Q-Rocket Lab Site and Six Mission Reports
Qrocketlab (Q-Rocket Lab), the studio of Qodri Muhammad, sells business-intelligence "mission reports" as proof of what it can do. This review tests the Qrocketlab public website and six of those reports with three lenses at once: engineering, industry knowledge, and logic. The aim is to find where a claim goes further than its data. It is an analysis of published material, not a judgment of Qodri Muhammad's intent or ability.
RAHMAT WIBOWO | 24 OCTOBER 2026
Snapshot
- The site is well built. It runs on Next.js with an aggressive edge cache and HTTP/3. Public pages cost almost nothing per visit. That part is worth keeping.
- The trust layer behind it is thin. The only security header served is
upgrade-insecure-requests. Payment and personal-data compliance are open questions, not proven violations. - The six reports share the same weaknesses. Across them I counted 9 findings rated critical. Five reports get major revision and one, the HR case study, gets inadequate.
- One pattern explains most of it. Revenue is treated as profit, and one or two months of data are called a trend. Both are cheap to fix.
How the review was done
Three lenses, one standard: a claim is only as strong as its evidence and its method.
- Engineering. I read the site only from what it serves to any visitor: the HTML, the JavaScript bundles, the CSS and the response headers. I ran no active scans and made no login attempts. Anything I could not see is reported as not measured, not as safe.
- Domain. Is the business reasoning right for that industry: laundry, arcades, seed farming, interior design, HR?
- Logic. Where does an argument jump further than its numbers allow?
One honest limit applies to all six reports. I worked from text extracts, so I could not see the charts inside the reports. Any claim that depends on a chart is marked unverified. It is not assumed to be correct, and it is not assumed to be wrong.
Part I: The site
| Layer | What is visible | Evidence |
|---|---|---|
| Framework | Next.js App Router, React 18 | x-powered-by: Next.js, App Router chunks |
| Delivery | Aggressive edge cache, HTTP/3 | x-nextjs-cache: HIT, s-maxage=31536000, alt-svc: h3 |
| Hosting | Hostinger, LiteSpeed server | server: LiteSpeed, platform: hostinger |
| Security headers | One directive only | content-security-policy: upgrade-insecure-requests |
The delivery layer is a real strength. A one-year edge cache makes public pages nearly free to serve. The security-header layer is an unlocked door. There is no HSTS, no X-Frame-Options, no X-Content-Type-Options and no real script-src policy.
The bundles show nine API endpoints. Three of them carry direct reputational risk:
| Endpoint | Why it matters | Risk |
|---|---|---|
commerce/lynkid/checkout | Money moves here. Bank Indonesia's rules on payment service providers apply, so the compliance status should be confirmed | High |
client/login | Identity. Login endpoints are where weak headers and weak rate limits hurt most | High |
subscribe | Contact data. The Personal Data Protection Law (UU 27/2022) requires a lawful basis and a privacy notice | High |
The integrations visible in the code are Cloudflare Turnstile, LynkID and a B2 media proxy. To be clear: the payment-licence and PSE-registration questions are open, not answered. I found no proof of a breach. They belong on a to-do list with a data classification, not in an accusation.
Part II: Six mission reports, claim by claim
Each report was attacked on three axes: data and method, domain depth, and fallacy. For each one I also say what held up, because each report gets some important things right.
RPT-001 Gaming Arcade, Ciputat: Revenue and Operations
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "Cash dominates at 73%" (10,921 of 14,960 transactions) | The March accounting shows cash and QRIS close to 50-50 by value. If the POS records payment method this badly, every conclusion drawn from the POS stands on data that has not been reconciled | Non sequitur | Critical |
| "Ramadan is peak season, +73.6%" | Four months of data contain one Ramadan. Other causes are not controlled for | Post hoc, hasty generalisation (n=1) | High |
| "Delivery is 4.3x more efficient per transaction" | Revenue per transaction is not efficiency. Delivery and packaging costs are not counted | Revenue treated as profit | High |
What held up. The POS-versus-accounting gap is disclosed, not hidden. Keeping Ramadan out of the projection baseline is the right instinct.
Verdict: major revision. Reconcile the data first, reframe revenue as margin, and base projections on a real trend.
RPT-002 Wares Quick Laundry, Bekasi: Capacity and Growth
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "May is a record, a consistent upward trend" | May is a partial month (20 days) compared with a full April | Unequal periods, hasty generalisation | High |
| "Bottleneck: 86.4% utilisation at 09:00" | That is an average, not peak concurrency. Queues form in the busiest minutes | Ecological fallacy, base-rate neglect | High |
| "Machine ROI is very short" | ROI needs net cash flow after electricity, water, detergent and labour, not gross revenue | Revenue treated as profit | High |
What held up. The binding constraint, machine-hours, is correctly identified. "Watch the queue before you buy another machine" is wise operational advice.
Verdict: major revision. Compare equal periods, measure peak concurrency, and build unit economics on margin.
RPT-003 HPL Press Services, Bandung: Market Entry
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "April is already profitable, Rp 1.9 million" | The Rp 154 million CAPEX is charged once and then ignored. Monthly depreciation is missing from the cost structure | Non sequitur | Critical |
| "Revenue grew 105%" | A combined February-March period is compared with April alone. Two points are not a trend | Unequal periods, hasty extrapolation | Critical |
| "No competitors, a digital first mover" | Inferred from the absence of listings on one marketplace | Argument from ignorance | High |
What held up. The contribution-margin framework and the 68/80/100 percent utilisation sensitivity are solid. The report honestly shows a loss scenario.
Verdict: major revision. Move CAPEX into depreciation, normalise to a monthly basis, and headline the payback from the actual scenario, about 81 months.
RPT-004 Seed Farmer, Ngawi: Agricultural Market Opportunity
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "TAM of 7,711 tonnes, Rp 185-347 billion" | Built from a theoretical need of 25 kg per hectare. Most farmers use their own saved seed or subsidised seed | Unsupported market sizing, base-rate neglect | Critical |
| A stable "10-24%" margin with no climate risk | The whole thesis depends on a 4-6 week selling window, yet crop failure and a late season are missing | Base-rate neglect (climate), cherry-picking | Critical |
| "No certification, so 14-21 days faster" | Uncertified seed undercuts the report's own thesis that trust is the business's capital | Appeal to novelty | Critical |
What held up. The planting-season cycle is well understood. Offline distribution through farmer groups (poktan) is the right channel, and holding back from early digital over-investment is a mature call.
Verdict: major revision. Use the real commercial seed-replacement rate, model climate and subsidy risk, and separate the seed price from the grain price.
RPT-005 Room Column, Cimahi: Market Entry and Competition
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "20-25% of households are middle class or above (HDI 80.85)" | The Human Development Index is a composite of health, education and spending. It is not an income distribution | Ecological fallacy, proxy misuse | High |
| "Zero digital competitors" | Based on one marketplace query. Interior-design services sell through Instagram, WhatsApp and Google Maps | Argument from ignorance | High |
| A layered market estimate multiplied step by step | Four assumptions multiplied with no uncertainty range, then presented as a precise figure | False precision | Medium |
What held up. The honest disclosure ("not yet validated by a primary survey") appears exactly where the estimate is weakest, and the closing recommendation is realistic.
Verdict: major revision. Replace the HDI proxy with per-capita spending data, and test "zero competitors" in the channels where the trade actually happens.
RPT-006 HR Business Case, "ABC Corporation"
| Claim | Why it does not hold | Fallacy | Severity |
|---|---|---|---|
| "A case study of ABC Corporation" | A generic placeholder name, with no industry, testimonial or baseline, and round numbers with no source. It reads as an illustrative model packaged as real work | Hypothetical presented as a real case | Critical |
| "A domino effect from one strategic gap" | The whole cascade is traced to a single root cause, but organisations have many causes at once | Single cause, causal oversimplification | Critical |
| "60x return, Rp 122 billion of cost avoided" | No cost model, no counterfactual and no definitions. A 60x return on training and development is not credible | Appeal to big round numbers, false precision | Critical |
What held up. The budget arithmetic is consistent (45/30/25 percent = Rp 900/600/500 million = Rp 2 billion) and is mapped to concrete activities. Measuring each pillar against a baseline with pulse surveys is correct practice.
Verdict: inadequate. The design and measurement plan are tidy, but all three core claims are critical at once. As marketing, or as the basis for a Rp 2 billion investment decision, this report cannot be defended until it is relabelled and given an explicit cost model.
Part III: The same errors, again and again
This is where combining the three lenses pays off. The same mistakes recur, so fixing each one once, in the template, fixes every report.
| Fallacy | Appears in | The single fix |
|---|---|---|
| Revenue treated as profit | 001, 002, 003, 004 | Every "efficient", "ROI" or "profitable" claim must use contribution margin |
| Hasty generalisation (n=1 or two months) | 001, 002, 003 | Do not say "trend" under six months. Label it ramp-up and give a range |
| Unequal periods compared | 002, 003 | Normalise every figure to a per-month basis before comparing |
| Argument from ignorance ("no competitors") | 003, 005 | Check the real channels (Instagram, Maps, WhatsApp) before calling a market empty |
| False precision | 001, 002, 003, 004 | Round, and show a range |
| Base-rate neglect | 001, 004, 006 | Make industry benchmarks and a bad-case scenario mandatory |
| Single cause, post hoc | 001, 006 | List alternative causes before naming one |
| Average or index used as a proxy | 002, 005 | Do not infer individual traits from an aggregate index. Measure concurrency, not averages |
| Cherry-picked periods | 001, 002, 003, 004 | Fix the baseline and the period split before looking at results |
| Unsupported market sizing | 003, 004, 005 | Tie market figures to real demand and real channels |
| Hypothetical presented as a real case | 006 | Label clearly: illustrative, or a real client anonymised |
Part IV: A new standard
This week
- Adopt a house rule: no "efficient", "ROI" or "profitable" claim without a contribution margin behind it.
- Add security headers to the site: HSTS,
X-Content-Type-Options,X-Frame-Optionsand a real CSPscript-src. - Label the HR case study clearly: illustrative, or a real anonymised client with verified metadata.
This month
- Require a one-page "limits and assumptions" section in every report: sample size, baseline and a bad-case scenario.
- Reconcile data sources (POS against accounting) before drawing segment conclusions.
- Document the contract of each API endpoint, and make the payment webhook idempotent.
This quarter
- Build a standard report template that forces uncertainty ranges, benchmarks and sensitivity analysis.
- Settle the payment-licence and PSE-registration questions with a short legal opinion.
- Set a three-tier data classification, and reduce the dependence on one founder for account recovery.
Verdict panel
| Subject | Verdict | Heaviest issue |
|---|---|---|
| Qrocketlab site (engineering) | Pass with fixes | Minimal security headers; payment and PDP compliance open |
| RPT-001 Gaming Arcade | Major revision | POS and accounting data contradict each other |
| RPT-002 Wares Laundry | Major revision | Bottleneck read from an average, not peak concurrency |
| RPT-003 HPL Press | Major revision | CAPEX charged once; best-case payback |
| RPT-004 Seed Farmer | Major revision | Theoretical market sizing; climate risk missing |
| RPT-005 Room Column | Major revision | HDI used as a proxy for income class |
| RPT-006 HR "ABC Corporation" | Inadequate | Single root cause, 60x ROI, case appears hypothetical |
Why the Qrocketlab review matters beyond one studio
Small consultancies in Indonesia increasingly sell analysis to small businesses: a laundry owner deciding whether to buy a machine, a farmer group deciding how much seed to stock. Those owners usually cannot check the method. When a report confuses revenue with profit, the cost of that error falls on the client who acts on it. The discipline asked for here is not extra talent. It is a template that forces four habits: use margin instead of revenue, state the sample limit, include a bad-case scenario, and label what is hypothetical.
None of the findings above attack intent or capability. They all attack the distance between a claim and its evidence, and that distance can be closed.
Limits and right of reply
The engineering findings come from public artifacts of the site only. API behaviour and internal server configuration were not observed. The report findings come from text extracts, and chart contents were not seen and are not claimed to have been seen. Severity reflects the damage if a weak claim were used to make a decision. It is not an accusation of bad faith. Compliance points are open questions, not findings of a breach. This is not legal or financial advice.
Right of reply. Qodri Muhammad, Qrocketlab, and any business named in the reports, can send corrections to admin@infraloka.co.id. A proven correction will be added to the next version of this post.
Related reviews
- A Fair Review of a Mentor's Own Site: gedearya.com uses the same public-artifacts method on a personal site.
- A Fair Audit of an SEO Manager's Own Showcase Site: Kapten SEO checks a showcase site against its own claims.
- Seven Logical Fallacy Families Behind Never-Hire Lists explains several of the fallacies named above.
References
- Bank Indonesia. (2021). Board of Governors Regulation on payment service providers. https://www.bi.go.id
- Badan Pusat Statistik. (2024). Welfare indicators and agricultural statistics. https://www.bps.go.id
- Ministry of Communication and Informatics. (2020). Ministerial Regulation 5/2020 on private-scope electronic system operators (PSE). https://www.komdigi.go.id
- Government of the Republic of Indonesia. (2022). Law No. 27 of 2022 on Personal Data Protection. https://peraturan.bpk.go.id
#QodriMuhammad #Qrocketlab #FairReview #LogicalFallacies