The agent added debug logging and wrote the Authorization header to plaintext logs
The agent traced a failing call by logging the whole header map, so the Authorization bearer token landed in plaintext logs on every retry. Local tests use a dummy token and miss it, but aggregation keeps the real credential. Debugging needs the request's shape, not its secrets.