> If you think Log4j is bad, wait until Rust gets popular and has something similar happens with a commonly used crate. How would you scan for a vulnerability i

> If you think Log4j is bad, wait until Rust gets popular and has something similar happens with a commonly used crate. How would you scan for a vulnerability in compiled code that doesn't even have separate module files? Our software scans take 3 forms: 1. Searching for file names 2. Running test exploits that have a payload that just logs the vulnerability with a central monitoring system 3. Dependency resolution and checks against a DB (our solution _already_ supports Cargo.lock files. Rust (and Go, C++, etc.) only prevent option 1. Thanks to bundlers it also can miss it in JS, or shaded fatjars it can also fail kn Java too. So it's not a new challenge