Here on lirantal.com
Research write-ups, developer tools, and things I learn along the way.
Browse the blog →Articles · Tutorials · Research write-ups
Writing, across the web.
I write to make security easier to understand and put into practice. Here’s where to find my work, from deep dives into vulnerable code to the tools I use every day.
Node.js Security
Vulnerability deep dives and practical secure coding for JavaScript developers.
Read Node.js Security →Snyk
Articles and research on AI security, application security, and the software supply chain.
Browse my Snyk writing →Selected reading
Published elsewhere.
Snyk Articles
January 2026
Building Secure MCP Servers: A Developer’s Guide to Avoiding Critical Vulnerabilities ↗
Command injection, path traversal, and the pitfalls of read-only database access in MCP servers.
Node.js Security
November 2025
Argument Injection vulnerability in git-blame@1.4.0 ↗
How an unsanitized revision parameter becomes a command execution risk in a Git wrapper.
Snyk Blog
July 2025
Cursor IDE Malware Extension Compromise in $500k Crypto Heist ↗
A look at malicious extensions and the trust developers place in their tools.
Lirantal.com
Recent posts from my blog.
Self-Hosting Hermes Agent with Matrix E2EE on Proxmox
Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.
The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph
A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.
Building a Second Brain with LLMs and AI Agents
How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.
Invisible Unicode Can Hijack Gemini CLI Agent Skills
I disclosed a Gemini CLI prompt injection where invisible Unicode tag characters in SKILL.md caused the agent to run a hidden command. Google closed the report as out of scope because the workspace was trusted and YOLO mode was enabled.
Build Agent Workflows Around State Ownership, Not Timing
A practical pattern for turning a fragile Codex state migration into a reusable skill with backups, process ownership, validation, and a terminal helper.
How to Turn a Custom Terminal Setup into Portable Dotfiles with chezmoi
A practical guide to turning a custom macOS terminal setup into portable, reviewable dotfiles with chezmoi, Homebrew Bundle, zsh modules, Starship, and a public-safe repository workflow.
DevRel in 2026: Thematic Shifts, Product-centric Advocacy and the Rising Tide of Coding Agents
Explore DevRel in 2026: how coding agents, AI builders, X-first communities, DevRel engineering, and product-centric advocacy are reshaping the field.
Coding Agents Do Not Replace Technical Proficiency — They Demand More of It
LLMs and coding agents amplify developer capability but they do not substitute for it. Engineering experience determines whether you steer these tools toward sound architecture or blindly accept generated output that drifts from your conventions.