Hacker News Reader

Might work for config files but would it work for environment variables?

It would for env vars as well, why not? Just trace program trying to reach out for some var X from env.

afaik reading env vars requires no sys calls and thus will not appear in strace

So there should be a different tool used which will intercept environment variables reads and will log them.