Google indexed a client's internal search results. Disaster.

Google indexed a client's internal search results. Disaster.
Found /search?q=... URLs in the index — thousands of them, generated by users and bots typing random junk into site search. Including some embarrassing queries. All thin, all indexed.
Google explicitly hates indexed internal search pages. It's near the top of their thin-content list.
The move:
— Blocked /search and the query param in robots.txt.
— Added noindex to the search template as a belt-and-suspenders backup (robots block alone won't de-index already-indexed URLs).
— Removed them via GSC removal tool to speed cleanup.
— Made sure no internal links pointed at search-result URLs (a common "popular searches" widget sin).
Watch the order: noindex must be readable, so DON'T robots-block until the noindex pages drop out of the index. Block first, and Google can't see the noindex to act on it.