‘Hack DHS’ bug bounty program expands to Log4j security flaws