Liran Tal

@lirantal.com

🦄 Node.js Secure Coding: http://nodejs-security.com 🌟 @GitHub Star 🏅 @OpenJS Pathfinder award for Security 🥑 DevRel at @snyksec

Bye bye “State Of” reports. Benchmarks are the new “blog post”. This is a post for all of you DevRel friends out there.

if you think engineering and technical savy is unimportant beacuse you can just ask the agent... well, here's yet another example of pushing back and steering agents away from disaster and disappointed users

Bild

snapshot from the Snyk VulnBench when I set out to build the benchmarking harness so if I were to build a new benchmark - what questions would you want it to answer... ?

Bild

If you're doing development within an AI-assisted IDE which maintains the chat and the traditional editor experience, how do you think of this agentic security experience with Snyk? it effectively runs health checks on an agent suggested packages to audit that the package is legitimate (and not ma

Bild

from a conversation with a good friend about an agentic tool... it's in Hebrew but basically it is "my agent replied to your agent" 😆

Bild

Aerospace tiling is really cool and genuinely useful but the whole workspace via shortcuts is not productive when I can just swipe left/right with the magic mouse on a mac how are you all using it?

in case you were living under a rock and missed the OpenAI + Hugging Face incident from last week... Here, I highlighted everything you need to know from the incident report. Maybe emergent properties? Maybe Skynet early days. Maybe a nice PR. Either way, stay vigilant.

Bild

I was really hoping to use VS Code for managing the second brain Obsidian-like vault but the extensions and overall capabilities are just terrible What did you all do? Just use Obsidian?

Here's the highlight from Snyk VulnBench that we published: Claude Sonnet 4.6 Medium produced the most one-off extra vulnerability reports: 61.7% of its LLM-only reports appeared in just one of five runs Ask yourself - how does instructing Claude Code to find vulnerabilities impacts vulnerability

Bild

Snyk VulnBench JS 1.0 shows that the best-scoring LLM configuration reached 75.4% Snyk-reference F1, leaving a 24.6-point gap against deterministic SAST reference reproduction. Go read up on this coding agents security benchmark Trusting your Claude Code or other harness to just "find all vulner

Bild

DevRel friends you should invest more in doing deep research I ran the VulnBench benchmark project at Snyk, which now graduated to a full-time Forward Research initiative under DevRel, and it's not only satisfying from a technical perspective but also incredibly energising to dive into the detail

Bild

trustworthiness is engineered, and it's engineered where Snyk operates (context, tooling, guardrails) thanks for coming to my ted talk

What we're setting up to explore as part of Snyk's Forward Research benchmarks is the through-line of the harness-sensitivity spine: not the model. The harness defines how the agent is built, grounded, and governed. Follow for updates 👀

The OpenJS Foundation contributors leaderboard 🎉 Thank you to all of the amazing humans, some of whom are on this list that I am grateful to call friends, for building a better open-source world for us ❤️

Bild

Reasons to use subagents: □ Context window: remains unpolluted on the main agent session □ Access: gated access of tool calls per subagent □ Reasoning: model + the reasoning effort level specific to the subagent's task □ Prompt: the repeatable instructions are kept within the subagents (no need for

guess what really unlocks agentic loops? verifiable software ;-) yep, you still need to write tests, have a deterministic CI setup, and... security controls