The Bedrock client now always sets Authorization: null in defaultHeaders and re-injects the bearer or service-tier headers explicitly. This stops a leaked Authorization header from a parent fetch leaking into Bedrock requests.
Evidence
Bedrock client builder (search for Authorization: null).
Strings lifted out of the shipped bundle, so the claim above can be checked against them.