01
Basic-auth or cookie, either works
Whatever your staging environment already uses to keep it private — no new gate to punch a hole through. There's no need to weaken your staging security to let a crawler in, or set up a separate, less-protected staging environment just to make it crawlable — the audit works with the same protection you already have in place. It's built around whatever protection your team already trusts, not a new system to learn. It's built to work with staging setups exactly as they already exist, not a specific configuration you'd have to adopt.
02
Encrypted at rest
Credentials are encrypted before storage, not sitting in plaintext next to the rest of your site settings. That's the same standard you'd expect for any credential a third-party tool stores on your behalf, so adding staging access doesn't mean introducing a new, weaker link into your security posture. It's the same baseline of care you'd expect for any credential handed to a third-party tool. It's treated with the same seriousness as any other sensitive credential in the system.
03
Same rules, same score
A staging crawl runs the identical rule set as production, so the score you see pre-launch is the score you'd actually get. There's no separate, lighter "staging mode" that might miss something — whatever passes on staging is genuinely ready, and whatever fails would fail in production too. That parity is what makes the pre-launch score something you can actually plan around. There's no asterisk on the pre-launch number that says it might change once things go live.