- Tag all read and/or write on process.env - Report every URL - Report every usage of node child_process - Detect serialization of os or dns variables