Skip to content

Software Engineer · London, UK

Laurentiu Robert Niculescu

I build the software, and I run the servers it sits on.

I started on first-line IT support in 2023 and moved into building whatever the work needed. A 14,000-line Windows security auditing tool in Python. A multi-tenant client platform in TypeScript that two companies run their week on. Two live web apps, sitting on Linux servers I provision and harden myself.

The security half started because clients kept asking whether they were safe and I wanted a better answer than a shrug. I'm studying for a BSc in Software Engineering alongside the job, and I'm looking for a software engineering role in London.

Get in touch GitHub Download CV

Selected work

All projects

ShadowAudit

Ongoing

A Windows security auditing tool that shows its working

lines of Python
14,000
read-only checks
17
tools in the family
3
  • Python
  • Tkinter
  • Pillow
  • PyInstaller
  • WinRM

Client Management Platform

Ongoing

A multi-tenant portal that two client companies run their week on

lines of TypeScript
15,000
roles across two tiers
6
database per tenant
1:1
  • TypeScript
  • Node.js
  • Express
  • React
  • SQLite
  • JWT
  • +1

KitDesk

June 2025 - Present

Equipment booking and asset tracking, live on the web and on Google Play

approved on Google Play
Aug 2026
build serves every customer
1
scanner fallbacks
3
  • React
  • Vite
  • Tailwind CSS
  • Node.js
  • Express
  • MongoDB
  • +3

Writing

All posts

The permission check that did two jobs

One flag guarded both "can see every client" and "can create logins". Splitting it into two questions took an afternoon. Noticing it took a year.

My DMARC check passed domains that had no protection at all

Looking for the record is not the same as reading it. A substring match gave a green tick to `+all` and to `p=none`, which are the two ways of having the record and none of the benefit.

258MB of JSON, and the query parameter that fixed it

An endpoint that worked fine in testing started returning 502s in production. The response was a quarter of a gigabyte, and most of it was photographs.

What I work with

Languages
TypeScript, Python, JavaScript, SQL, Bash
Web
React, Node.js, Express, Astro, Tailwind CSS, Vite
Data
MongoDB, SQLite, Mongoose, REST APIs
Infrastructure
Linux (AlmaLinux, Debian), nginx, WireGuard, pm2, VPS provisioning
Security
Host hardening, Lynis, fail2ban, UFW, SPF/DKIM/DMARC, vulnerability assessment