# Neciu Dan

> Personal site of Neciu Dan — Staff Engineer, host of the Señors @ Scale podcast, ReactJS Barcelona organizer, and international speaker. Covers frontend engineering, testing, security, performance, and engineering career topics.

## About

- [About Neciu Dan](https://neciudan.dev/about): Background, talks, and what he works on
- [Newsletter](https://neciudan.dev/#subscribe): Subscribe for new posts and podcast episodes

## Blog

- [Blog index](https://neciudan.dev/blog): JavaScript, React, testing, security, and engineering career articles
- [RSS feed](https://neciudan.dev/rss.xml): Full-content RSS

## Podcast — Señors @ Scale

- [Podcast hub](https://neciudan.dev/senors-at-scale): Conversations with senior engineers about scale, performance, and the realities of large frontend systems
- [Episode takeaways](https://neciudan.dev/takeaways): Per-episode key takeaways in markdown
- Listen on [Spotify](https://open.spotify.com/show/7FVT93UTOhafvQeZGKmV60), [Apple Podcasts](https://podcasts.apple.com/us/podcast/se%C3%B1ors-at-scale/id1827500070), and [YouTube](https://www.youtube.com/@NeciuDan/)

## Course — Master Security in Frontend Applications

Free, self-paced course on frontend security across React, Vue, Angular, and Vanilla JS. All 7 modules are live. Lesson content is free but requires sign-in to read. No credit card required.

- [Master Security overview](https://neciudan.dev/master-security): Course landing page, full curriculum, and sign-up

### Module 1 — Exploits & Supply Chain
- [Understanding package.json and Dependency Versioning](https://neciudan.dev/course/master-security/1-exploits/lesson-1)
- [Anatomy of npm Exploits — Real-World Attacks](https://neciudan.dev/course/master-security/1-exploits/lesson-2)
- [Defending Your Project — npm Security Best Practices](https://neciudan.dev/course/master-security/1-exploits/lesson-3)
- [Security Tooling — Scanners, Auditors, and Automated Defense](https://neciudan.dev/course/master-security/1-exploits/lesson-4)
- [Build Your Own npm Vulnerability Scanner](https://neciudan.dev/course/master-security/1-exploits/lesson-5)
- [Containerized Development and Testing with Docker](https://neciudan.dev/course/master-security/1-exploits/lesson-6)
- [Incident Response and Putting It All Together](https://neciudan.dev/course/master-security/1-exploits/lesson-7)

### Module 2 — Cross-Site Scripting (XSS)
- [What is Cross-Site Scripting?](https://neciudan.dev/course/master-security/2-xss/lesson-1)
- [Stored, Reflected, and DOM-Based XSS](https://neciudan.dev/course/master-security/2-xss/lesson-2)
- [XSS in React, Vue, Angular, and Vanilla JS](https://neciudan.dev/course/master-security/2-xss/lesson-3)
- [XSS Meets OAuth: From Script Injection to Account Takeover](https://neciudan.dev/course/master-security/2-xss/lesson-4)
- [When AI Writes Your XSS: Prompt Injection, Slopsquatting, and LLM-Rendered Payloads](https://neciudan.dev/course/master-security/2-xss/lesson-5)
- [CSP, Trusted Types, and the Sanitizer API](https://neciudan.dev/course/master-security/2-xss/lesson-6)
- [Auditing Your App for XSS: A Practical Checklist](https://neciudan.dev/course/master-security/2-xss/lesson-7)

### Module 3 — AI Security & Insecure Software
- [The New Attack Surface: Security in the Age of AI](https://neciudan.dev/course/master-security/3-ai/lesson-1)
- [Prompt Injection: Direct, Indirect, and Jailbreaks](https://neciudan.dev/course/master-security/3-ai/lesson-2)
- [When AI Writes Insecure Code](https://neciudan.dev/course/master-security/3-ai/lesson-3)
- [Agentic AI, Tool Use, and MCP Security](https://neciudan.dev/course/master-security/3-ai/lesson-4)
- [Data Leakage, RAG Poisoning, and Sensitive Information Disclosure](https://neciudan.dev/course/master-security/3-ai/lesson-5)
- [Building Secure AI-Powered Features: A Defense Playbook](https://neciudan.dev/course/master-security/3-ai/lesson-6)

### Module 4 — CSRF & Spoofing Attacks
- [What is CSRF? The Confused Deputy Problem](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-1)
- [CSRF in Depth: GET, POST, JSON, and Login CSRF](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-2)
- [Defending Against CSRF: SameSite, Tokens, and Origin Checks](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-3)
- [Clickjacking & UI Redressing](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-4)
- [Spoofing Attacks: Identity, Domain, and Content](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-5)
- [Putting It Together: A Request-Integrity & Anti-Spoofing Checklist](https://neciudan.dev/course/master-security/4-csrf-spoofing/lesson-6)

### Module 5 — Personal Security & Scam Prevention
- [The Developer Threat Model: Why You're a Target](https://neciudan.dev/course/master-security/5-personal-security/lesson-1)
- [Phishing & Social Engineering in the AI Era](https://neciudan.dev/course/master-security/5-personal-security/lesson-2)
- [Account Security: Passwords, MFA, and Passkeys](https://neciudan.dev/course/master-security/5-personal-security/lesson-3)
- [Securing Your Devices & Developer Environment](https://neciudan.dev/course/master-security/5-personal-security/lesson-4)
- [Protecting Your Identity, Data & Money from AI-Powered Scams](https://neciudan.dev/course/master-security/5-personal-security/lesson-5)
- [Your Personal Security Playbook & Incident Response](https://neciudan.dev/course/master-security/5-personal-security/lesson-6)

### Module 6 — Broken Access Control
- [What is Broken Access Control? OWASP's #1 Risk](https://neciudan.dev/course/master-security/6-access-control/lesson-1)
- [IDOR and Broken Object Level Authorization (BOLA)](https://neciudan.dev/course/master-security/6-access-control/lesson-2)
- [Privilege Escalation and Missing Function-Level Authorization](https://neciudan.dev/course/master-security/6-access-control/lesson-3)
- [Frontend-Specific Access Control Pitfalls](https://neciudan.dev/course/master-security/6-access-control/lesson-4)
- [CORS, Mass Assignment, and Metadata Manipulation](https://neciudan.dev/course/master-security/6-access-control/lesson-5)
- [Designing and Testing Access Control](https://neciudan.dev/course/master-security/6-access-control/lesson-6)

### Module 7 — Security Misconfiguration
- [What is Security Misconfiguration?](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-1)
- [Security Headers Done Right](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-2)
- [Exposed Secrets, Source Maps & Verbose Errors](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-3)
- [Cloud & Storage Misconfiguration](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-4)
- [Default Credentials, Unnecessary Features & Dependency Config](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-5)
- [Hardening & Automating Configuration Security](https://neciudan.dev/course/master-security/7-misconfiguration/lesson-6)

## Workshops

- [From Lizard to Wizard](https://neciudan.dev/lizard-to-wizard): 4-hour remote frontend system design intensive — chat app architecture, microfrontends, BFF/SDUI, event-driven architecture, observability. Next session: Thursday May 28, 2026.
- [Sign up — From Lizard to Wizard](https://neciudan.dev/lizard-to-wizard/signup): Direct signup link with seat reservation

## Optional

- [llms-full.txt](https://neciudan.dev/llms-full.txt): Concatenated full content of blog posts and podcast takeaways for retrieval
- [Sitemap](https://neciudan.dev/sitemap-index.xml): Full site URL index