Don’t forget about capslock: https://github.com/google/capslock

Assess your 3P modules for dangerous capabilities