Add option to hide Environment Variables from all Globals

Description

I am looking for a way to hide Environment Variables from $_SERVER or from all Global Arrays.
I would prefer to secure my environment variables as much as possible and make them explicit when using.

I only require getenv('my_env_var');
I do not want or need $_SERVER['my_env_var'] or $_ENV['my_env_var'].

There are many third-party tools and libraries that might expose $_SERVER in logs or debugging. Also if the code is compromised dumping $_SERVER is very easy. This could be mitigated by encrypting Environment Variables, but I would also like to make accessing them very explicit.

Currently I can set clear_env to yes and change variables_order to "GPCS" and ignore "E" to remove $_ENV, but I can't remove "S" as that is needed for REMOTE_ADDR, etc.

Changing clear_env does remove any server configured environment variables, but it still adds any environment variables being added from php-fpm config file when doing env[some_name] = some_value. I would need all those to be hidden from $_SERVER as well and only accessible via getenv().

It would be nice to have another php config option to do that and have that option accessible from php-fpm config as well like clear_env or variables_order

Maybe something like expose_env. Default is yes, but can be set to no.
no should remove it from $_SERVER as well as $_ENV or any other Global data.

Bonus points if no can also remove it from, errors, functions (like debug_backtrace), etc.

Thanks

Commencez par examiner comment les options existantes clear_env et variables_order alimentent $_SERVER et $_ENV, ainsi que la manière dont les valeurs env[...] de php-fpm sont traitées. Définissez la portée de l’option et vérifiez que la désactivation de l’exposition masque ces valeurs des tableaux globaux tout en laissant getenv() utilisable ; le comportement demandé pour les erreurs et debug_backtrace constitue une question ouverte supplémentaire.