Co-authored preprints
Papers
Research on agent skills, the repeatability of AI security review, and vulnerability remediation.
Research
Investigating how systems fail.
I study the trust we place in software: the dependencies we install, the code we review, and the tools we give to AI agents. Here are the findings, disclosures, and defenses that came out of that work.
- Critical-severity advisories
- 7
Among the active records
Citations & h-index on Google Scholar
Research snapshot: Oct 19, 2026. Counts cover the work listed here. Citation totals are available on my Google Scholar profile.
01 / Explore the research
From a finding to a fix, a paper, or a shared practice.
Industry research · 2019 & 2022
Reports & chapters
Contributions to HTTP Archive’s Web Almanac and Snyk’s State of Open Source Security report.
Software engineering · Filed 2013
Patents
A patent application connecting manual testing, screen states, and contextual software localization.
Coordinated vulnerability disclosure
CVEs & advisories
Publicly credited disclosures across developer tooling, web packages, runtimes, and MCP servers.
Software supply chain · 2019 →
Lockfile injection
Original 2019 research, lockfile-lint, and the GitLab work that extended it at Black Hat Europe 2021.
Developer security guidance · 2019 →
npm security
The original npm security best practices, their adoption by OWASP, and ongoing package-manager guidance.
AI & agentic security · 2025 →
AI & agents
Agent skill ecosystem threats, MCP vulnerability disclosures, and benchmarks for AI security tools.
Incident analysis & defensive tooling · 2018 →
Supply chain
The event-stream post-mortem, source-code defenses, and tools that turn research into development safeguards.
02 / Recent papers
Co-authored research, with the full methods and evidence.
How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0
An evaluation of deterministic SAST and AI security agents on 108 vulnerabilities across 20 open-source applications, examining coverage, harness policy, and cost. Snyk Code and Claude Code’s strongest evaluated configuration together covered 101 of 108 vulnerabilities.
VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Reports & chapters
Explore reports & chaptersHTTP Archive · · Co-author
Web Almanac 2022 — Security
A data-driven chapter examining web security adoption, including transport security, cookies, security headers, browser protections, and correlations with technology stacks and website popularity.
Saptak Sengupta, Liran Tal, and Brian Clark
Snyk · · Research contributor · Analysis author
State of Open Source Security 2019
Research into vulnerabilities in indirect dependencies and the challenges of remediation. The linked analysis is part of Snyk’s annual report and includes a link to the complete report.
Liran Tal — author of the linked indirect-dependency analysis, published as part of the report.
03 / Research in practice
What happens after publication matters, too.
From lockfiles to Black Hat
GitLab’s Dennis Appelt and Greg Johnson extended my 2019 lockfile injection research to more techniques and ecosystems, presenting their work at Black Hat Europe 2021.
A foundation for OWASP guidance
The npm security best practices I co-authored with Juan Picado became the original basis of OWASP’s NPM Security Cheat Sheet.