My apologies, I wasn't clear. I agree, audited code can have bugs - but I'm not assuming that the presence of the bug was the indicator that it hadn't been audi

My apologies, I wasn't clear. I agree, audited code can have bugs - but I'm not assuming that the presence of the bug was the indicator that it hadn't been audited. I'm taking the fact that I haven't heard of log4j being audited, the fact that I haven't heard of Apple auditing an external product before importing it into their environment, and the fact that auditing open-source software isn't standard practice among tech companies to make that assumption. ...although, the bug is sort of blatant. I would hope that an audit would catch this particular one, at least.