# CorePanel control panel — private infrastructure, not public content.
#
# Crawling is intentionally ALLOWED here. That looks backwards, but it is what
# actually keeps the panel out of search results: de-indexing is done by the
# `<meta name="robots" content="noindex, ...">` in index.html, and the SPA
# fallback returns that same document for every path. A crawler must be able to
# fetch the page to read the directive; a URL blocked by robots.txt can still be
# listed in search results (URL only, no snippet), which is the outcome we want
# to avoid. Do not replace this with `Disallow: /` — it would suppress the
# noindex instead of reinforcing it.
#
# /api/ is blocked because there is nothing there to read: it only answers
# JSON-RPC POSTs and requires authentication.

User-agent: *
Disallow: /api/
Allow: /