Docs about package indices can be misleading.

[stefanondisponibile]

I was reading the documentation and I find this statement about package indexes could be misleading:

Here's an example of setting up the default environment to look at 2 private indices (using context formatting for authentication) before finally falling back to PyPI:

[tool.hatch.envs.default.env-vars]
PIP_INDEX_URL = "https://token:{env:GITLAB_API_TOKEN}@gitlab.com/api/v4/groups/<group1_path>/-/packages/pypi/simple/"
PIP_EXTRA_INDEX_URL = "https://token:{env:GITLAB_API_TOKEN}@gitlab.com/api/v4/groups/<group2_path>/-/packages/pypi/>simple/ https://pypi.org/simple/"

As far as I know this can be true, but one could be tricked into thinking that he could safely set the PIP_INDEX_URL to its private pypi repository and be safe from "dependency confusion" (some pip context, and uv). Is that correct or I am unaware of some extra hatch specific feature?

Poetry provides an interesting feature for sourcing dependencies to specific repositories, is this currently possible with hatch?