# Nothing is crawlable. No exceptions.
#
# This briefly allowed the homepage and /legal/ so Stripe's automated onboarding
# check could fetch them — a fully-disallowed site is reported by a compliant
# crawler as unreachable, which is how that check failed. That verification is
# now being handled by a human reviewer instead, so the exception was removed
# (2026-08-07) rather than left open for a need that no longer exists.
#
# robots.txt is only advice to well-behaved crawlers. The real enforcement is
# server-side: self-identifying bots receive a 404 on every path, the storefront
# sits behind researcher attestation, and X-Robots-Tag noindex is sent on every
# response. This file is the polite layer, not the boundary.
#
# Product imagery under /images/products/ is deliberately served publicly so that
# email clients can render it — an inbox cannot pass the attestation gate. That
# is a separate concern from crawling, and the bot 404 still applies there.
User-agent: *
Disallow: /