My guess is that this blurb is relevant:

> rack-mini-profiler runs in the development environment by default in Rails apps. We're going to enable it in production, and hide it behind a URL parameter. You can also do things like make it visible only to admin users, etc.

No. RMP is disabled by default in production and must be enabled manually with `Rack::MiniProfiler.authorize_request` - so you can set it up behind a URL parameter, or something more secure like your already-built admin system or whatever.