[Istof]

somewhat unrelated but if you email a private URL to a Microsoft email address, they will also crawl it, about once a month (I get an email anytime someone access it and MS bot is the only one accessing it). Not sure if Google also does that...

[kardos]

This is why I always put a user/pass on any private URL

I don't think their URL scanners are clever enough to dig through emails and try user/pass combos