rsbadger

Unfortunately not - the links were indexed and shown in Bing search results

I do have a robots.txt to block this directory. But Bing only listens to that for what to crawl, not what to index.

I’m fairly certain they are. My links ended up indexed in Bing search results. The only place they were ever rendered was in private emails to users. Bing should not be indexing that.

Exactly that.

This is very useful information. You’d really hope that private emails would be excluded by default…

The only purpose of this link was to verify that the email address is valid. Once it’s verified, you can login.

Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?

You’re right that it was a bit of an oversight on my behalf, as the links were only generated after a verified human user action (signup) I had assumed the 1 time links to their email would be safe. But regardless of the link action, it shouldn’t be passing that data to Bingbot to crawl and (possibly) index in search engine results. Private email data should not be shared with search engine crawlers IMO.

I would be pretty mortified if browsers were using user browser sessions to scan content and pass it to bingbot…? What about if you’re browsing something local? Or your bank account?

Exactly - seems the safest way is to explicitly block known bots by user agent from even reaching pages you don't want indexed.