Wikimedia Bugzilla is closed!

Requiring a password for a category page does not prevent the 
articles in that category from being listed on the "Login 
Required" page shown to those not logged in.  This is 
probably not going to upset most people much, because it is 
only the names of the pages which are shown, not the content 
of them.  But it's clearly not the behavior an admin will 
expect, and should be changed.