I only use robots.txt for pages that already issues 403. Something like this:

  User-agent: *
  Disallow: /secret/