Review how environment variables are used. Ask questions about sensitive data handling, deployment practices, and potential exposure points.