you better test for log4j behind your waf, because you know they’re just gonna find a way to bypass that shit anyway