How did my dev site end up in the search results?

[DmitriiK]

Robots.txt won't help anyhow. Bots still can see that there is such directory, they just won't see what's inside of those directories/subdomains.

[EcommerceSite]

We never updated the robots.txt because the site was behind a firewall. If you click on any of the results it will not load the page unless on my VPN.

[EcommerceSite]

They are telling me that there are no holes, and I have tried getting to the pages but can not do it unless I am on my vpn.

[DmitriiK]

Then there is a leak somewhere - Google bots can "see" your subdomain.

Or it's been simply linked from somewhere. Then Google will try to follow the link and that would make it indexed.

[DmitriiK]

Then my first assumption is that it's linked from somewhere - read my comment a little above.

[EcommerceSite]

I have ran screaming frog to see if there are any links to any pages and but couldn't see any. Even if Google did try to follow it the firewall would stop them. It is so strange.

[DmitriiK]

I never used screaming frog, does it check both external and internal links?

[EcommerceSite]

It just uses internal links. Do you think I should try the webmaster tools removal? That seems like it could go wrong.

[DmitriiK]

Don't use tool removal, it can go bad indeed. Now, are you sure that there are no external links coming from anywhere?

For now I'd recommend putting noindex, nofollow on that dev subdomain and do manual recrawl through GWT.

[MattRoney]

Personally, I'd still recommend using robots.txt to disallow all crawlers, even if more steps are taken.