See this on github

Plugins specify permissions:

To make a method public, it should be included in the anonymous array in the permissions object. e.g. the example in the above linked file makes a localPeers method public:

permissions: { anonymous: [ 'localPeers' ]
}, createHistoryStream has it specified here:

anonymous is the permission group that all remote callers are in by default. The local user and ssb-master-authenticated callers can call any method by default.