Add OopsSec Store to Apps section

[kOaDT]

Adds OopsSec Store to the Apps section.

What it is

An intentionally vulnerable e-commerce application built on the Next.js App Router, React, TypeScript and Prisma. It ships 36 CTF challenges across 11 chapters, each with a walkthrough that goes from vulnerability to exploit to fix.

Why it belongs on this list

It is a Next.js learning resource first, a security lab second. Most vulnerable-app projects target older stacks (Juice Shop on Express/Angular, DVWA on PHP), so the lessons do not transfer to how Next.js developers actually ship code. This one puts the vulnerability classes where Next.js developers meet them:

• NEXT_PUBLIC_ secrets leaking into the client bundle
• Trust boundaries between Server Components, Client Components and Server Actions
• Middleware used for authorization and the ways that fails
• Route Handlers and IDOR / broken access control in the App Router
• Prisma query construction and injection
• Prompt injection against an AI support agent, MCP tool poisoning, and an npm typosquat supply-chain chain
• Several challenges reproduce published CVEs against this stack

The point is that a Next.js developer walks away knowing how to secure their own app, not just how to break someone else's.

Details

• MIT licensed, open source
• Runs in under a minute: npx create-oss-store my-ctf-lab or docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store
• Listed in the OWASP Vulnerable Web Applications Directory
• Free walkthroughs for every challenge: https://koadt.github.io/oss-oopssec-store

The app is designed to be run locally in an isolated environment and carries explicit warnings against production deployment.

Checklist

• Searched previous suggestions for duplicates — no security/CTF lab currently on the list
• Individual pull request for a single suggestion
• Title casing (AP style)
• Format: [Title Case Name](link) - Description.
• Description starts with a capital, ends with a period
• Spelling and grammar checked
• No trailing whitespace