This question came up. Obviously GA won't count bots that don't parse JavaScript, since the whole thing works off having users run ga.js. But is it 100% safe to assume none of the traffic shown by Analytics is made up of bots?