The first pass reported that five firms carried noindex on their homepage. That would have been a serious accusation, and it was false. We were close to publishing it with the firms named.
The tell was that all five pages were within a few hundred bytes of each other. Five unrelated companies do not produce near identical homepages. They were all the same Cloudflare challenge page, and its noindex tag is correct behaviour: an interstitial genuinely should not be indexed. The firms had done nothing wrong. Our crawler had simply never reached their sites.
Checking that led to a real bug. Our robots.txt parser accepted whatever it was handed. Given an HTML challenge page at /robots.txt, it found no directives it recognised and returned its default, which is that every crawler is allowed. A confident all clear, derived from a file it never actually read.
That was live in our free audit and our crawler checker. It is fixed. The body is now checked to see whether it is a robots.txt at all, and when it is not, the answer is that we could not read it rather than a reassuring guess.
The crawler blocking findings survived the same scrutiny. Each was confirmed by fetching the file independently, and each turned out to be a genuine, explicit Disallow: /. Those numbers stand.
This section exists because the failure mode is the whole point. A tool that reports confidently on data it could not collect is worse than no tool, whether it errs towards alarm or towards reassurance. The only defence is checking a finding against the thing itself before publishing it, which is also why no firm is named anywhere on this page.