If you mean it's turning into a grinding and repetitive groundhog day, I concur. We don't even use log4j and yet are fielding a steady stream of requests to re

If you mean it's turning into a grinding and repetitive groundhog day, I concur. We don't even use log4j and yet are fielding a steady stream of requests to reassure clients that we've mitigated against it, which hasn't been an issue because we don't use it (although we do use log4net with Stackify and it's certainly a possibility that may be compromised in future), and of course are having to audit all our own suppliers. I encourage companies to post information on their websites about this so we don't all have to keep emailing you (I'm trying to get some info up on ours detailing mitigations, for similar reasons; once it's there I can send some all company comms and hopefully never see another email in my inbox with "log4j" in the subject line). Of course, this whole issue is crucially important to deal with, but it's also frustrating because it's an entirely non-value-adding time-vampire.