User-agent: *
Allow: /

# The staff pages (review.html, registrations.html, dashboard.html) are still not
# listed here. A Disallow line does nothing to stop anyone reading a page, and
# robots.txt is world-readable, so naming them would hand every scraper a tidy
# directory of admin URLs. What keeps them out of search results is the
# <meta name="robots" content="noindex, nofollow"> on each one.
#
# The site index (pages.html) does not name them either. It links to hub.html,
# which asks for a passcode and only then draws the links that passcode opens —
# so the URLs are not in any page's source until someone has proved they belong
# there. That is a findability fix, not a security control: the passcode was
# always the only real control, checked again on the server for every request.
# pages.html and hub.html are both noindex, nofollow.
#
# Worth knowing: the passcode gates ARE now rate limited. This note used to say
# they weren't, and asked whoever added it to come back and say so — so: failed
# attempts are counted per gate in 15-minute windows, and a gate stops answering
# once there have been too many. It counts nothing about who was asking: a gate
# name, a window and a number. See supabase/functions/_shared/rate-limit.ts for
# the thresholds and what was deliberately left out, including the two endpoints
# that are exempt because they are public forms.
#
# What that does NOT do is make a guessable passcode safe. It caps guessing at a
# few thousand a day, which is a wall in front of a long random passcode and a
# speed bump in front of a memorable one.

Sitemap: https://bringyourbills.org.au/sitemap.xml