Variable precedence between shared and private HTTP client environments

Testing an integration against a sandbox without committing production credentials is a common use case for the IntelliJ-based HTTP client. The documented credential-free pattern uses a shared http-client.env.json for non-secret defaults and a local http-client.private.env.json for secrets that should not be committed.

The design relies on environment selection in the request editor and on the IDE keeping private files out of version control. It is unclear whether the private file is guaranteed to be ignored by VCS or only offered for ignore on creation, and whether that behavior is enforced across workspaces.

Precedence is also uncertain. When the same variable name is defined in both the shared and private files for the active environment, the value actually sent is not obvious from the editor gutter alone and may be version-sensitive.

Which value does the HTTP client use for duplicate keys, private or shared? Is the private environment file automatically excluded from version control, or does the ignore depend on an opt-in prompt? Which IDE documentation confirms precedence for a specific build?