Course
JavaScript for Real Applications
Modern JavaScript for engineers who ship: ES2020+ syntax, async that doesn't bite back, modules, npm hygiene, and the JS bugs that actually get exploited.
Modern JavaScript, Actually
ES2020+ syntax and module semantics you will use daily — plus the clone traps and import footguns nobody warns you about.
- 01Optional Chaining, Nullish Coalescing, and the End of && GuardsRead nested, maybe-missing data safely — and stop letting `||` rewrite your `0`s and empty strings.20mOpen
- 02ES Modules in Node and the BrowserStatic and dynamic imports, Node's strict resolution rules, CJS interop seams, and why `import(userInput)` is a loaded gun.25mOpen
- 03Destructuring, Spread, and the Clone TrapsSanitize objects with rest, clone them with structuredClone — and learn why `{...req.body}` is a mass-assignment bug.25mMembers
Async JavaScript Without the Footguns
The event loop, Promise combinators, and cancellation — written for people who have shipped a race condition to production.
- 01The Event Loop Is a Queue, Not a MetaphorMicrotasks vs macrotasks, why `await` isn't atomic, and how a 300 ms JSON.parse takes down your health check.30mMembers
- 02Promise.all, allSettled, race, any: Pick the Right CombinatorFail-fast vs collect-everything, bounded concurrency in 15 lines, and why unhandled rejections now kill your process.30mMembers
- 03Cancellation and Timeouts with AbortControllerAbortSignal.timeout, AbortSignal.any, and honoring signals in your own code — every outbound call needs a deadline.30mMembers
Shipping It: Tooling and Supply-Chain Security
npm, lockfiles, build-time secrets, and the JavaScript-specific vulnerabilities that show up in real code review.
- 01npm, Lockfiles, and Dependency HygieneLifecycle scripts are RCE during install. Lockfiles, `npm ci`, typosquats, and dependency confusion, practically.30mPremium
- 02Prototype Pollution, eval, and the XSS You ShippedThe three JS-specific bug classes from real reviews: polluted prototypes, string-to-code sinks, and DOM XSS.35mPremium
- 03Environment Variables, Secrets, and Build-Time RealityWhy `VITE_` means public, where `.env` actually belongs, and startup validation that fails before your first request.25mPremium