Kontexta

amitfeldmanhq

The pitch is "governed execution" for AI agents — which makes the outside view interesting, because right now the page itself is ungoverned. Quick passive check (headers + served HTML only, what any visitor's browser sees):No Content-Security-Policy at all, no HSTS, no X-Frame-Options/frame-ancestors, no Permissions-Policy. nosniff and Referrer-Policy are set, so someone has touched the headers — the four that matter most just never landed. For a tool asking devs to trust it inside their agent workflows, CSP + HSTS are the two I'd close first; since it's Next.js behind Cloudflare, both are config, not code (middleware header block, or a Cloudflare Transform Rule).www.kontexta.dev has no DNS record at all — not a broken page, the name simply doesn't resolve. A slice of people type www out of habit and will assume the product is down. One CNAME + a redirect rule at Cloudflare fixes it in minutes.Small alongside: access-control-allow-origin: * rides on the homepage (harmless on a static page, but worth tightening), and no security.txt — for a security-adjacent dev tool, that file is a cheap trust signal.robots.txt and sitemap.xml are clean, http 301s to https correctly, and the meta description is actually written. The base is fine — it's the trust surface that needs one config pass to match the pitch.