> You shouldn't need to pour over code to figure it out.

It's not just your code that is vulnerable.

Our in-house software doesn't use log4j, but a number of third-party components we use do and needed to be patched.