A user from the community has reported this issue.

Basically, jBPM is including basic authorization information in errai security context.
So, this task is to remove such sensitive data from the context.
The attached gif shows how to check this issue.