QuickPod

amitfeldmanhq

GPU rental means users paste cloud credentials and Jupyter tokens into your flow, so the outside view matters. Passive check only (headers plus served HTML - what any visitor's browser sees):None of the six baseline security headers are set on either host: no HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy. HSTS is the urgent one for a paid-compute product - without it, a first visit on hostile wifi can be downgraded before your http->https 301 even fires. You're behind Cloudflare, so the whole set is a Transform Rule, not code.quickpod.io and www.quickpod.io both return 200 with an identical ETag - no canonical redirect, so every page exists twice and link equity splits across two copies. Pick one host and 301 the other; one Redirect Rule at Cloudflare./.well-known/security.txt returns 200 with text/html - the SPA fallback, not a contact file. For an infra provider a real security.txt is the cheapest trust signal going; right now a researcher who finds something in the GPU stack has no front door.Genuine credits: title, meta description and OG tags are all written and specific, robots.txt + sitemap.xml are live, and http 301s to https on both hosts. The plumbing is right - it needs one canonical host and a header pass to match the paid-compute positioning.