# Test with https://technicalseo.com/tools/robots-txt/
# Marketing surface remains indexable (default Allow).
# Disallow personalized / flow routes that never produce valid pages for bots — they
# only blow up when crawled (e.g. Googlebot on /a/:returnToken → "return token X not
# associated w/ an entity", pages the oncall). Scrapers that ignore robots.txt are
# handled separately via per-caller severity downgrades.

User-agent: *

# Auth / return-token landing (triggered Googlebot Subclass B: DedupKeys 5A09ADA8, 75E7B778, etc.)
Disallow: /a/
Disallow: /auth/

# Flow routes (subsumes /asset/a/ and /mortgage/a/ return-token variants)
Disallow: /origination/
Disallow: /shared/
Disallow: /asset/
Disallow: /mortgage/
Disallow: /deposit/
Disallow: /cardholder/
Disallow: /portal/
Disallow: /retention/
Disallow: /creditLimitIncrease/
Disallow: /partnersHandoff/

# Point crawlers at the sitemap so indexable marketing content is discovered.
# (Host: is non-standard — Google dropped it in 2018, Bing never supported it.)
Sitemap: https://www.aven.com/sitemap.xml