Really sorry to post publicly about this, but I have contacted the plugin author @kaktak privately and received no reply. Itโs a security issue which can affect sites using this plugin, so at some point I have to tell the community.
Security issue: the plugin bypassees site-wide login_required, leaking content which would normally be behind a site login into the public llms.txt.
Important corollary: it doesnโt bypass security in Category visibility or private messages, so itโs not as bad as it could be!
The plugin controller calls skip_before_action :redirect_to_login_if_required, so on a login-required site the output lists topics that anonymous users cannot otherwise see. The per-category and per-topic routes do apply Guardian checks.
My advice on any login-required sites is to disable this plugin until fixed. I know that might not be many sites since needing an llms.txt and having โlogin-requiredโ set are somewhat mutually exclusive for most users.
Now that a generated LLMs.txt has shipped in core, there is a reduced need for this plugin anyway.