[Xylakant]

But there is nothing to indicate either in the post or in the referenced SO thread that the URLs are published to the search results. They are visited by bingbot, that much seems confirmed, but there’s no example where one of these results shows up in the public search results.

[rsbadger]

They were indexed in Bing results, I’ve shared the URL of that in this thread

[cma]

Holy shit thats bad. Do unlisted youtube and gdrive share links get indexed through this?

[9dev]

You’d assume those have proper robots.txt configuration?

[boxed]

I have a disallow all robots.txt for a production system. Have had from the beginning.

Bing indexes it. This is my first major security incident and I have no idea how to fix this without making everything totally shitty for the users.

[efreak]

Some services ignore global disallow, but will respect rules explicitly targeted at them.

[boxed]

I've put in a hard block for all crawlers on all pages. Works for my scenario I think. Hopefully they don't lie in their user agent. Then it's going to be really bad.