docs: document environment variables

docs/detectors/go.md

@@ -36,3 +36,10 @@ Go detection will fallback if no Go v1.11+ is present.
 
 Due to the nature of `go.sum` containing references for all dependencies, including historical, no-longer-needed dependencies; the fallback strategy can result in over detection.
 Executing `go mod tidy` before detection via fallback is encouraged.
+
+## Environment Variables
+
+If the environment variable `EnableGoCliScan` is set, to any value, the Go detector uses [`go mod graph`][1] to discover Go dependencies.
+If the environment variable is not present, we fall back to parsing `go.mod` and `go.sum` ourselves.
+
+[1]: https://go.dev/ref/mod#go-mod-graph

docs/detectors/pip.md

@@ -35,3 +35,8 @@ Pip detection will not run if `python` is unavailable.
 If no `bdist_wheel` or `bdist_egg` are available for a given component, dependencies will not be fetched.
 
 If no internet connection or a component cannot be found in Pypi, said component and its dependencies will be skipped.
+
+## Environment Variables
+
+The environment variable `PyPiMaxCacheEntries` is used to control the size of the in-memory LRU cache that caches responses from PyPi.
+The default value is 128.

docs/environment-variables.md

@@ -0,0 +1,15 @@
+# Environment Variables
+
+Environment variables are sometimes used to control experimental features or advanced options
+
+## `EnableGoCliScan`
+
+If the environment variable `EnableGoCliScan` is set, to any value, the Go detector uses [`go mod graph`][1] to discover Go dependencies.
+If the environment variable is not set, we fall back to parsing `go.mod` and `go.sum` ourselves.
+
+## `PyPiMaxCacheEntries`
+
+The environment variable `PyPiMaxCacheEntries` is used to control the size of the in-memory LRU cache that caches responses from PyPi.
+The default value is 128.
+
+[1]: https://go.dev/ref/mod#go-mod-graph