Co-authored preprints
Papers
Research on agent skills, the repeatability of AI security review, and vulnerability remediation.
Research
Investigating how systems fail.
I study the trust we place in software: the dependencies we install, the code we review, and the tools we give to AI agents. Here are the findings, disclosures, and defenses that came out of that work.
- Critical-severity advisories
- 7
Among the active records
Citations & h-index on Google Scholar
Research snapshot: Oct 19, 2026. Counts cover the work listed here. Citation totals are available on my Google Scholar profile.
01 / Explore the research
From a finding to a fix, a paper, or a shared practice.
Software engineering · Filed 2013
Patents
A patent application connecting manual testing, screen states, and contextual software localization.
Coordinated vulnerability disclosure
CVEs & advisories
Publicly credited disclosures across developer tooling, web packages, runtimes, and MCP servers.
Software supply chain · 2019 →
Lockfile injection
Original 2019 research, lockfile-lint, and the GitLab work that extended it at Black Hat Europe 2021.
Developer security guidance · 2019 →
npm security
The original npm security best practices, their adoption by OWASP, and ongoing package-manager guidance.
AI & agentic security · 2025 →
AI & agents
Agent skill ecosystem threats, MCP vulnerability disclosures, and benchmarks for AI security tools.
Incident analysis & defensive tooling · 2018 →
Supply chain
The event-stream post-mortem, source-code defenses, and tools that turn research into development safeguards.
02 / Recent papers
Co-authored research, with the full methods and evidence.
October 2026
arXiv · Preprint
VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Gabija Pasiunaite, Ryan McMorrow, Brian Clark, Liran Tal, and Luke Tu
June 2026
arXiv · Preprint
Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.
Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair
03 / Research in practice
What happens after publication matters, too.
From lockfiles to Black Hat
GitLab’s Dennis Appelt and Greg Johnson extended my 2019 lockfile injection research to more techniques and ecosystems, presenting their work at Black Hat Europe 2021.
A foundation for OWASP guidance
The npm security best practices I co-authored with Juan Picado became the original basis of OWASP’s NPM Security Cheat Sheet.