I research emerging threats and build open-source defenses for AI agents, the software they write, and the tools they trust.
Software engineer, security researcher, and open-source maintainer.
Leading Developer Relations at Snyk.
My work spans AI agents, developer tooling, and software supply chain security: co-authored papers, vulnerability disclosures, patents, and research that became practical defenses.
An evaluation of deterministic SAST and AI security agents on 108 vulnerabilities across 20 open-source applications, examining coverage, harness policy, and cost. Snyk Code and Claude Code’s strongest evaluated configuration together covered 101 of 108 vulnerabilities.
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Lint lockfiles for trusted registries and protect against lockfile injection.
Check package health and security signals before installing npm dependencies.
A practical guide to building thoughtful, accessible, and reliable command-line applications.
Articles on security, developer tooling, and what I’m building.
Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.
A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.
How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.
Plenty of live hacking. I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code.
Sep 17, 2026–Oct 16, 2026. Includes dependency installs.
As of Oct 20, 2026.
#1 for JavaScript and #1 for PHP on GitRanks. Profile updated November 4, 2026.
Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects.
Dark Reading
Expert commentary · English
Comments to Dark Reading and quotations from my research on node-ipc sabotage and the risks of transitive dependencies.
TheMarker
Quoted & mentioned · Hebrew
Ran Bar-Zik quotes and mentions me in his reporting on AI-assisted coding and the security risks facing inexperienced developers.
Geektime
Research featured · Hebrew
Coverage of my node-ipc investigation, including its destructive behavior and the implications for software supply chain security.
The New Stack
Talk featured · English
Bill Doerrfeld highlights my AGNTCon + MCPCon talk on malicious agent skills and practical defenses against agents installing malware.
HPE sponsored this article.
From the community
“Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.”
“FANTASTIC WORKSHOP! Learned a ton! Thanks a lot 🙏”
“This has become my primary source for learning docker with node. Thanks for sharing these 💝”
“This is one of the best guides I’ve seen on this topic, really cool stuff.”
