Qodri Muhammad and Qrocketlab: A Fair Review of the Q-Rocket Lab Site and Six Mission Reports

Qrocketlab (Q-Rocket Lab), the studio of Qodri Muhammad, sells business-intelligence "mission reports" as proof of what it can do. This review tests the Qrocketlab public website and six of those reports with three lenses at once: engineering, industry knowledge, and logic. The aim is to find where a claim goes further than its data. It is an analysis of published material, not a judgment of Qodri Muhammad's intent or ability.

RAHMAT WIBOWO | 24 OCTOBER 2026

---

Snapshot

• The site is well built. It runs on Next.js with an aggressive edge cache and HTTP/3. Public pages cost almost nothing per visit. That part is worth keeping.
• The trust layer behind it is thin. The only security header served is upgrade-insecure-requests. Payment and personal-data compliance are open questions, not proven violations.
• The six reports share the same weaknesses. Across them I counted 9 findings rated critical. Five reports get major revision and one, the HR case study, gets inadequate.
• One pattern explains most of it. Revenue is treated as profit, and one or two months of data are called a trend. Both are cheap to fix.

How the review was done

Three lenses, one standard: a claim is only as strong as its evidence and its method.

1. Engineering. I read the site only from what it serves to any visitor: the HTML, the JavaScript bundles, the CSS and the response headers. I ran no active scans and made no login attempts. Anything I could not see is reported as not measured, not as safe.
2. Domain. Is the business reasoning right for that industry: laundry, arcades, seed farming, interior design, HR?
3. Logic. Where does an argument jump further than its numbers allow?

One honest limit applies to all six reports. I worked from text extracts, so I could not see the charts inside the reports. Any claim that depends on a chart is marked unverified. It is not assumed to be correct, and it is not assumed to be wrong.

Part I: The site

Layer	What is visible	Evidence
Framework	Next.js App Router, React 18	x-powered-by: Next.js, App Router chunks
Delivery	Aggressive edge cache, HTTP/3	x-nextjs-cache: HIT, s-maxage=31536000, alt-svc: h3
Hosting	Hostinger, LiteSpeed server	server: LiteSpeed, platform: hostinger
Security headers	One directive only	content-security-policy: upgrade-insecure-requests

The delivery layer is a real strength. A one-year edge cache makes public pages nearly free to serve. The security-header layer is an unlocked door. There is no HSTS, no X-Frame-Options, no X-Content-Type-Options and no real script-src policy.

The bundles show nine API endpoints. Three of them carry direct reputational risk:

Endpoint	Why it matters	Risk
commerce/lynkid/checkout	Money moves here. Bank Indonesia's rules on payment service providers apply, so the compliance status should be confirmed	High
client/login	Identity. Login endpoints are where weak headers and weak rate limits hurt most	High
subscribe	Contact data. The Personal Data Protection Law (UU 27/2022) requires a lawful basis and a privacy notice	High

The integrations visible in the code are Cloudflare Turnstile, LynkID and a B2 media proxy. To be clear: the payment-licence and PSE-registration questions are open, not answered. I found no proof of a breach. They belong on a to-do list with a data classification, not in an accusation.

Part II: Six mission reports, claim by claim

Each report was attacked on three axes: data and method, domain depth, and fallacy. For each one I also say what held up, because each report gets some important things right.

RPT-001 Gaming Arcade, Ciputat: Revenue and Operations

Claim	Why it does not hold	Fallacy	Severity
"Cash dominates at 73%" (10,921 of 14,960 transactions)	The March accounting shows cash and QRIS close to 50-50 by value. If the POS records payment method this badly, every conclusion drawn from the POS stands on data that has not been reconciled	Non sequitur	Critical
"Ramadan is peak season, +73.6%"	Four months of data contain one Ramadan. Other causes are not controlled for	Post hoc, hasty generalisation (n=1)	High
"Delivery is 4.3x more efficient per transaction"	Revenue per transaction is not efficiency. Delivery and packaging costs are not counted	Revenue treated as profit	High

What held up. The POS-versus-accounting gap is disclosed, not hidden. Keeping Ramadan out of the projection baseline is the right instinct.

Verdict: major revision. Reconcile the data first, reframe revenue as margin, and base projections on a real trend.

RPT-002 Wares Quick Laundry, Bekasi: Capacity and Growth

Claim	Why it does not hold	Fallacy	Severity
"May is a record, a consistent upward trend"	May is a partial month (20 days) compared with a full April	Unequal periods, hasty generalisation	High
"Bottleneck: 86.4% utilisation at 09:00"	That is an average, not peak concurrency. Queues form in the busiest minutes	Ecological fallacy, base-rate neglect	High
"Machine ROI is very short"	ROI needs net cash flow after electricity, water, detergent and labour, not gross revenue	Revenue treated as profit	High

What held up. The binding constraint, machine-hours, is correctly identified. "Watch the queue before you buy another machine" is wise operational advice.

Verdict: major revision. Compare equal periods, measure peak concurrency, and build unit economics on margin.

RPT-003 HPL Press Services, Bandung: Market Entry

Claim	Why it does not hold	Fallacy	Severity
"April is already profitable, Rp 1.9 million"	The Rp 154 million CAPEX is charged once and then ignored. Monthly depreciation is missing from the cost structure	Non sequitur	Critical
"Revenue grew 105%"	A combined February-March period is compared with April alone. Two points are not a trend	Unequal periods, hasty extrapolation	Critical
"No competitors, a digital first mover"	Inferred from the absence of listings on one marketplace	Argument from ignorance	High

What held up. The contribution-margin framework and the 68/80/100 percent utilisation sensitivity are solid. The report honestly shows a loss scenario.

Verdict: major revision. Move CAPEX into depreciation, normalise to a monthly basis, and headline the payback from the actual scenario, about 81 months.

RPT-004 Seed Farmer, Ngawi: Agricultural Market Opportunity

Claim	Why it does not hold	Fallacy	Severity
"TAM of 7,711 tonnes, Rp 185-347 billion"	Built from a theoretical need of 25 kg per hectare. Most farmers use their own saved seed or subsidised seed	Unsupported market sizing, base-rate neglect	Critical
A stable "10-24%" margin with no climate risk	The whole thesis depends on a 4-6 week selling window, yet crop failure and a late season are missing	Base-rate neglect (climate), cherry-picking	Critical
"No certification, so 14-21 days faster"	Uncertified seed undercuts the report's own thesis that trust is the business's capital	Appeal to novelty	Critical

What held up. The planting-season cycle is well understood. Offline distribution through farmer groups (poktan) is the right channel, and holding back from early digital over-investment is a mature call.

Verdict: major revision. Use the real commercial seed-replacement rate, model climate and subsidy risk, and separate the seed price from the grain price.

RPT-005 Room Column, Cimahi: Market Entry and Competition

Claim	Why it does not hold	Fallacy	Severity
"20-25% of households are middle class or above (HDI 80.85)"	The Human Development Index is a composite of health, education and spending. It is not an income distribution	Ecological fallacy, proxy misuse	High
"Zero digital competitors"	Based on one marketplace query. Interior-design services sell through Instagram, WhatsApp and Google Maps	Argument from ignorance	High
A layered market estimate multiplied step by step	Four assumptions multiplied with no uncertainty range, then presented as a precise figure	False precision	Medium

What held up. The honest disclosure ("not yet validated by a primary survey") appears exactly where the estimate is weakest, and the closing recommendation is realistic.

Verdict: major revision. Replace the HDI proxy with per-capita spending data, and test "zero competitors" in the channels where the trade actually happens.

RPT-006 HR Business Case, "ABC Corporation"

Claim	Why it does not hold	Fallacy	Severity
"A case study of ABC Corporation"	A generic placeholder name, with no industry, testimonial or baseline, and round numbers with no source. It reads as an illustrative model packaged as real work	Hypothetical presented as a real case	Critical
"A domino effect from one strategic gap"	The whole cascade is traced to a single root cause, but organisations have many causes at once	Single cause, causal oversimplification	Critical
"60x return, Rp 122 billion of cost avoided"	No cost model, no counterfactual and no definitions. A 60x return on training and development is not credible	Appeal to big round numbers, false precision	Critical

What held up. The budget arithmetic is consistent (45/30/25 percent = Rp 900/600/500 million = Rp 2 billion) and is mapped to concrete activities. Measuring each pillar against a baseline with pulse surveys is correct practice.

Verdict: inadequate. The design and measurement plan are tidy, but all three core claims are critical at once. As marketing, or as the basis for a Rp 2 billion investment decision, this report cannot be defended until it is relabelled and given an explicit cost model.

Part III: The same errors, again and again

This is where combining the three lenses pays off. The same mistakes recur, so fixing each one once, in the template, fixes every report.

Fallacy	Appears in	The single fix
Revenue treated as profit	001, 002, 003, 004	Every "efficient", "ROI" or "profitable" claim must use contribution margin
Hasty generalisation (n=1 or two months)	001, 002, 003	Do not say "trend" under six months. Label it ramp-up and give a range
Unequal periods compared	002, 003	Normalise every figure to a per-month basis before comparing
Argument from ignorance ("no competitors")	003, 005	Check the real channels (Instagram, Maps, WhatsApp) before calling a market empty
False precision	001, 002, 003, 004	Round, and show a range
Base-rate neglect	001, 004, 006	Make industry benchmarks and a bad-case scenario mandatory
Single cause, post hoc	001, 006	List alternative causes before naming one
Average or index used as a proxy	002, 005	Do not infer individual traits from an aggregate index. Measure concurrency, not averages
Cherry-picked periods	001, 002, 003, 004	Fix the baseline and the period split before looking at results
Unsupported market sizing	003, 004, 005	Tie market figures to real demand and real channels
Hypothetical presented as a real case	006	Label clearly: illustrative, or a real client anonymised

Part IV: A new standard

This week

1. Adopt a house rule: no "efficient", "ROI" or "profitable" claim without a contribution margin behind it.
2. Add security headers to the site: HSTS, X-Content-Type-Options, X-Frame-Options and a real CSP script-src.
3. Label the HR case study clearly: illustrative, or a real anonymised client with verified metadata.

This month

4. Require a one-page "limits and assumptions" section in every report: sample size, baseline and a bad-case scenario.
5. Reconcile data sources (POS against accounting) before drawing segment conclusions.
6. Document the contract of each API endpoint, and make the payment webhook idempotent.

This quarter

7. Build a standard report template that forces uncertainty ranges, benchmarks and sensitivity analysis.
8. Settle the payment-licence and PSE-registration questions with a short legal opinion.
9. Set a three-tier data classification, and reduce the dependence on one founder for account recovery.

Verdict panel

Subject	Verdict	Heaviest issue
Qrocketlab site (engineering)	Pass with fixes	Minimal security headers; payment and PDP compliance open
RPT-001 Gaming Arcade	Major revision	POS and accounting data contradict each other
RPT-002 Wares Laundry	Major revision	Bottleneck read from an average, not peak concurrency
RPT-003 HPL Press	Major revision	CAPEX charged once; best-case payback
RPT-004 Seed Farmer	Major revision	Theoretical market sizing; climate risk missing
RPT-005 Room Column	Major revision	HDI used as a proxy for income class
RPT-006 HR "ABC Corporation"	Inadequate	Single root cause, 60x ROI, case appears hypothetical

Why the Qrocketlab review matters beyond one studio

Small consultancies in Indonesia increasingly sell analysis to small businesses: a laundry owner deciding whether to buy a machine, a farmer group deciding how much seed to stock. Those owners usually cannot check the method. When a report confuses revenue with profit, the cost of that error falls on the client who acts on it. The discipline asked for here is not extra talent. It is a template that forces four habits: use margin instead of revenue, state the sample limit, include a bad-case scenario, and label what is hypothetical.

None of the findings above attack intent or capability. They all attack the distance between a claim and its evidence, and that distance can be closed.

Limits and right of reply

The engineering findings come from public artifacts of the site only. API behaviour and internal server configuration were not observed. The report findings come from text extracts, and chart contents were not seen and are not claimed to have been seen. Severity reflects the damage if a weak claim were used to make a decision. It is not an accusation of bad faith. Compliance points are open questions, not findings of a breach. This is not legal or financial advice.

Right of reply. Qodri Muhammad, Qrocketlab, and any business named in the reports, can send corrections to admin@infraloka.co.id. A proven correction will be added to the next version of this post.

Related reviews

• A Fair Review of a Mentor's Own Site: gedearya.com uses the same public-artifacts method on a personal site.
• A Fair Audit of an SEO Manager's Own Showcase Site: Kapten SEO checks a showcase site against its own claims.
• Seven Logical Fallacy Families Behind Never-Hire Lists explains several of the fallacies named above.

References

• Bank Indonesia. (2021). Board of Governors Regulation on payment service providers. https://www.bi.go.id
• Badan Pusat Statistik. (2024). Welfare indicators and agricultural statistics. https://www.bps.go.id
• Ministry of Communication and Informatics. (2020). Ministerial Regulation 5/2020 on private-scope electronic system operators (PSE). https://www.komdigi.go.id
• Government of the Republic of Indonesia. (2022). Law No. 27 of 2022 on Personal Data Protection. https://peraturan.bpk.go.id

#QodriMuhammad #Qrocketlab #FairReview #LogicalFallacies