Actually, the bug is not in the publication process, the bug is in the "Save Response" feature, when you prepare samples of your calls for publication. Have a look:

Here is what my response looks like:

Note that the headers and the base url are nicely tokenized.

After a save the response though, here's what the saved response looks like:

Note that the headers are still nicely tokenized, but for some reason the URL is no longer tokenized, rather it is fully resolved to the value of the environment variable. Thus, when generating the documentation, the URL shows up in the code samples.

The workaround to this issue is that the saved response must be edited to restore the token {{whatever}} into the url so that the resolved url is not exposed when the documentation is published. I tried this and it works.