I wrote about the lessons to be learned after the Log4j situation in Wizeline’s “The Pulse” blog. https://www.wizeline.com/log4shell-vulnerability-lessons-learned-for-developers-the-open-source-future/