thanks Petter after changing the redirect to a specific page this worked and passed the redirect check at SEO Agency - Strategy, Consulting & Link Building - Sure Oak
My settings now look like this

Interesting side effect, bubble resolves logged in redirects first as the redirect checker showed 3 URL’s. 1st redirecting a logged in user without sufficient privileges, the second redirecting if not logged in (as this doesn’t have a check for privilege)

so lessons for me are
- SS redirects are a must on all pages you want to protect in some way
- think about (and test!) your rules to make sure no client actions are required to stop this working as bubble will have to expose the page and this will briefly allow people to see the content
- use privacy rules everywhere
- hiding things is great for client experience but not for protecting your site.
Thanks everyone!