> ## Documentation Index
> Fetch the complete documentation index at: https://learn.mintlify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect private and sensitive information

> Separate content discovery from access control, keep secrets out of examples, and test what each audience can retrieve.

export const Quiz = ({question, answers, correctFeedback, incorrectFeedback}) => {
  const [selected, setSelected] = React.useState(null);
  const [checked, setChecked] = React.useState(false);
  const quizId = React.useId();
  const isCorrect = checked && answers[selected]?.correct;
  const reset = () => {
    setSelected(null);
    setChecked(false);
  };
  return <div className={"quiz-container" + (checked ? " quiz-checked" : "")}>
      <Badge color="green">Quiz</Badge>
      <p className="quiz-question" id={quizId + "-question"}>{question}</p>
      <div className="quiz-options" role="radiogroup" aria-labelledby={quizId + "-question"} aria-disabled={checked}>
        {answers.map((answer, i) => <label key={i} className={["quiz-option", !checked && selected === i ? "quiz-option-selected" : "", checked && answer.correct ? "quiz-option-correct" : "", checked && selected === i && !answer.correct ? "quiz-option-incorrect" : ""].filter(Boolean).join(" ")}>
            <input type="radio" name={"quiz-" + quizId} checked={selected === i} onChange={() => !checked && setSelected(i)} disabled={checked} />
            <span className="quiz-radio" />
            <span className="quiz-option-label">{answer.text}</span>
          </label>)}
      </div>
      {checked && <div className={"quiz-feedback " + (isCorrect ? "quiz-feedback-correct" : "quiz-feedback-incorrect")} role="status" aria-live="polite" aria-atomic="true">
          <span className="quiz-feedback-icon">{isCorrect ? "✓" : "✗"}</span>
          {isCorrect ? correctFeedback : incorrectFeedback}
        </div>}
      <div className="quiz-actions">
        {!checked ? <button className="quiz-btn quiz-btn-check" type="button" onClick={() => selected !== null && setChecked(true)} disabled={selected === null}>
            Check answer
          </button> : <button className="quiz-btn quiz-btn-reset" type="button" onClick={reset}>
            Try again
          </button>}
      </div>
    </div>;
};

Agent-friendly content should be easy for the right agent to find and use. That doesn't mean every agent should receive every page.

Discovery and authorization solve different problems. Files such as `llms.txt` help agents find content, but they can't control access to private pages or protect a sensitive value.

## Use access controls

If content is private, protect the page or site with authentication and authorization. Test access with the same roles and groups your users have.

Removing a link from navigation or `llms.txt` only makes a page less visible. Anyone—or any agent—with the URL may still be able to fetch it.

Before publishing, classify content:

* **Public**: Safe for anyone to read and reuse
* **User-only**: Available to authenticated users
* **Role-restricted**: Available only to specific groups
* **Internal**: Not part of the user documentation site
* **Secret**: Must not appear in documentation, source control, examples, or agent context

If you need to control access to pages, set up authentication and personalization for your site. See [Authentication setup](https://www.mintlify.com/docs/deploy/authentication-setup) in the Mintlify documentation for more information.

Store secrets in a secret manager, never in a documentation page. If you accidentally publish a secret, revoke or rotate the value immediately. Even if you edit the page later, the secret is compromised the moment it becomes public.

## Keep examples safe to copy

Use unmistakable placeholders such as `YOUR_API_KEY` and explain where readers should supply the real value. Never paste a working credential, private hostname, customer identifier, or production response into an example.

Check screenshots too. Browser tabs, account names, email addresses, tokens, and internal URLs can appear outside the area you meant to document.

Add automated secret scanning to the repository when possible, but don't rely on automation alone. Reviewers should ask whether every example is safe to publish and copy.

## Separate public and private sources

When an agent that helps maintain your documentation has access to both public and private repositories, make the boundaries between them explicit.

* State which source is canonical for each audience
* Avoid publishing internal instructions that contradict public guidance
* Keep pre-release terminology out of public answers until the feature ships

## Test access by audience

Add access cases to your evaluation set.

* Can a public user retrieve only public content?
* Can an authenticated user reach the right private guide?
* Does an unsupported request cause the agent to guess from internal context?
* Can an agent retrieve only public content?

Run these checks whenever permissions, connected repositories, or publication settings change.

## Respond to accidental exposure

If a secret reaches the repository or published site, removing the page is not enough. Revoke or rotate the value, remove it from the public surface, and follow your organization's incident process. Git history, caches, and copied agent context may preserve the old value.

<Quiz
  question="You remove an internal page from `llms.txt`, but its public URL still works. Is the page hidden from agents?"
  answers={[
{ text: "Yes. Agents only read pages listed in llms.txt", correct: false },
{ text: "No. The page needs authentication or another access control", correct: true },
{ text: "Yes, as long as it is also removed from navigation", correct: false },
{ text: "Only if the page contains code examples", correct: false },
]}
  correctFeedback="Right. `llms.txt` is a discovery aid, not an access-control system. Protect private content with authentication and authorization."
  incorrectFeedback="Removing links makes a page harder to discover but does not make a public URL private. Use access controls for restricted content."
/>

Next up: [Keep content agent-friendly over time](/courses/agent-friendly-content/ongoing-maintenance) — Maintain accuracy, terminology, evaluations, and access boundaries as the product changes.