Add option to hide Environment Variables from all Globals

Description

I am looking for a way to hide Environment Variables from $_SERVER or from all Global Arrays.
I would prefer to secure my environment variables as much as possible and make them explicit when using.

I only require getenv('my_env_var');
I do not want or need $_SERVER['my_env_var'] or $_ENV['my_env_var'].

There are many third-party tools and libraries that might expose $_SERVER in logs or debugging. Also if the code is compromised dumping $_SERVER is very easy. This could be mitigated by encrypting Environment Variables, but I would also like to make accessing them very explicit.

Currently I can set clear_env to yes and change variables_order to "GPCS" and ignore "E" to remove $_ENV, but I can't remove "S" as that is needed for REMOTE_ADDR, etc.

Changing clear_env does remove any server configured environment variables, but it still adds any environment variables being added from php-fpm config file when doing env[some_name] = some_value. I would need all those to be hidden from $_SERVER as well and only accessible via getenv().

It would be nice to have another php config option to do that and have that option accessible from php-fpm config as well like clear_env or variables_order

Maybe something like expose_env. Default is yes, but can be set to no.
no should remove it from $_SERVER as well as $_ENV or any other Global data.

Bonus points if no can also remove it from, errors, functions (like debug_backtrace), etc.

Thanks

Beginnen Sie damit zu lesen, wie die vorhandenen Optionen clear_env und variables_order $_SERVER und $_ENV befüllen und wie php-fpm env[...]-Werte verarbeitet werden. Legen Sie den Geltungsbereich der Option fest und überprüfen Sie, dass das Deaktivieren der Sichtbarkeit diese Werte aus den globalen Arrays ausblendet, während getenv() weiterhin verwendet werden kann; das angeforderte Verhalten für Fehler und debug_backtrace ist eine zusätzliche offene Frage.