---
# System prepended metadata

title: JavaScript 10-Week Learning Plan (Checklist)

---

# JavaScript 10-Week Learning Plan (Checklist)

## Week 1 --- JS Fundamentals

-   [ ] Variables: let, const, var
-   [ ] Data types
-   [ ] Functions (declaration, expression, arrow)
-   [ ] Objects & arrays
-   [ ] JS execution model
-   [ ] Practice: Explain 20--30 snippets line by line
[Reading](https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/JavaScript_basics)


## Week 2 --- DOM & Events

-   [ ] DOM tree understanding
-   [ ] Selecting & modifying elements
-   [ ] Event listeners
-   [ ] Event bubbling & capturing
-   [ ] fetch/XHR basics
-   [ ] Practice: Trace JS on real websites
-   [ ] Resource: DOM Crash Course (Traversy)

## Week 3 --- Scopes, Closures, Hoisting

-   [ ] Lexical scope
-   [ ] Closures
-   [ ] IIFE
-   [ ] Hoisting behavior
-   [ ] Practice: Read lodash functions
-   [ ] Resource: YDKJS --- Scope & Closures

## Week 4 --- Asynchronous JS

-   [ ] Callbacks
-   [ ] Promises
-   [ ] async/await
-   [ ] Event loop
-   [ ] Practice: Trace async flows
-   [ ] Resource: Async JS Crash Course

## Week 5 --- Web APIs & Front-end Logic

-   [ ] LocalStorage/SessionStorage
-   [ ] fetch() advanced usage
-   [ ] JSON handling
-   [ ] CORS basics
-   [ ] Practice: Analyze login flows
-   [ ] Resource: javascript.info/fetch

## Week 6 --- Node.js & Express

-   [ ] Node.js architecture
-   [ ] Modules: import/export, require
-   [ ] fs & path modules
-   [ ] Express routing & middleware
-   [ ] Practice: Read open-source Node apps
-   [ ] Resource: Express Docs

## Week 7 --- Security-Focused JS Reading

-   [ ] DOM XSS sinks & sources
-   [ ] Dangerous APIs (innerHTML, eval, etc.)
-   [ ] Prototype pollution basics
-   [ ] CSRF token reading
-   [ ] Auth/session logic in JS
-   [ ] Resource: PortSwigger DOM XSS

## Week 8 --- Real-World JS Reading

-   [ ] Minified code reading
-   [ ] Obfuscated JS basics
-   [ ] Using AST Explorer
-   [ ] Reading library source code (axios/jwt)
-   [ ] Practice: Rewrite complex code clearly

## Week 9 --- Secure Coding Patterns

-   [ ] Injection patterns
-   [ ] SSRF in Node.js
-   [ ] File upload logic
-   [ ] Race condition patterns
-   [ ] Regex DoS awareness
-   [ ] Resource: OWASP NodeGoat

## Week 10 --- Full Codebase Mapping

-   [ ] Choose one open-source JS app
-   [ ] Map file structure
-   [ ] Identify routes & controllers
-   [ ] Trace authentication flow
-   [ ] Trace API logic
-   [ ] Draw full architecture diagram
-   [ ] Identify 3--5 vulnerabilities
