I configured a fossil repository for non-public access only (nobody and anonymous have no privileges).

The RSS feed still shows the timeline to unauthenticated users.

Potential fix: If 'anonymous' cannot see the timeline turn RSS off.