Choosing Between Environment‑Variable Placeholders and Secret Storage API for Credential Isolation in VSCode Integration Tests

The goal is to run VSCode integration tests without exposing production credentials, using a documented method for secret handling.

Constraints include limited support for the Secret Storage API in VSCode versions prior to 1.70, potential visibility of environment variables to other processes, and the lack of automatic secret clearing in the test harness, which makes manual cleanup error‑prone.

Which approach reliably isolates test secrets across VSCode restarts without exposing values to other processes? Can the Secret Storage API be cleared automatically within the test harness, or is manual intervention unavoidable? What is the minimal VSCode version required for a stable secret‑storage workflow in CI?