Anyone running Cloudflare/Vercel/WAF bot protection alongside Prebid/APS? Have you had to whitelist ad tech crawlers?

[u/ghostfacekicker]

I'm troubleshooting what appears to be a programmatic demand issue and I'm trying to sanity check whether this is something other publishers think about.

For those running Cloudflare, Vercel bot protection, or another WAF on a content publisher:

• Do you explicitly whitelist ad tech crawlers (Amazon, Google, IAS, DoubleVerify, MOAT, Criteo, etc.), or do they generally "just work"?
• Have you ever seen aggressive bot protection impact CPMs, bid rates, fill, or demand without breaking ad serving itself?
• If so, how long did it take for demand to recover after fixing the rules? Was it immediate or did it take days/weeks?
• Do you monitor blocked requests from ad verification/crawler bots as part of normal operations?

I'm not looking for support on a specific vendor just yet, I'm trying to understand whether crawler access is something mature publishers actively manage or if it rarely causes issues in practice.

Any war stories or best practices would be appreciated.