HTTP Client environment file visibility and version control protection

Environment Variable Management

PhpStorm's built-in HTTP Client supports the use of http-client.env.json files to manage request variables across different environments. To prevent sensitive credentials from being committed to version control, the IDE provides a "Private" environment file option, which typically ensures the file is excluded from the project's git tracking by adding it to the .idea/gitignore.

Credential Exposure Constraints

While the private flag automates the ignore process, there is no native mechanism to prevent a user from manually overriding these git settings or accidentally hardcoding secrets directly within the .http request files themselves. This creates a risk where sensitive data may be leaked if the developer bypasses the intended environment file workflow.

• Is there a configuration to enforce the use of environment variables over hardcoded values in .http files?
• Can the IDE be configured to trigger a warning if a file marked as private is manually added to a commit?