Add OopsSec Store to a new Security section

[kOaDT]

What

Adds OopsSec Store to the list, under a new Security section.

A deliberately vulnerable e-commerce app built with the Next.js App Router, React, TypeScript and Prisma. 36 CTF challenges across web, API, auth, business logic, crypto, supply chain and AI/MCP, including real CVEs against this stack, each with a walkthrough explaining the vulnerability and its fix.

Why it belongs in awesome-nextjs

It is a security project, but the reason it is relevant here is that it is built on Next.js and teaches Next.js developers how their own apps break:

• Vulnerabilities are framed around Next.js-specific trust boundaries — the NEXT_PUBLIC_ client-bundle trap, server components, middleware, and Prisma — not generic PHP-era examples.
• Several challenges reproduce published CVEs against this exact stack.
• Every challenge ships a walkthrough that goes from vulnerability to exploit to fix, so the takeaway is a secure pattern for your own App Router code.
• Runs in under a minute: npx create-oss-store my-ctf-lab or docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store.

MIT licensed, actively maintained, listed in the OWASP Vulnerable Web Applications Directory.

Note on the new section

The app is intentionally vulnerable, so listing it under E Commerce or App next to production-ready templates could mislead people into using it as a starter. A dedicated Security section makes the intent unambiguous and leaves room for future security-related entries. Happy to drop the section and move the entry under App instead if you prefer.