diff --git a/buck-tools/onos_app.py b/buck-tools/onos_app.py
index 119d9f6cc2..bbb053c9a6 100755
--- a/buck-tools/onos_app.py
+++ b/buck-tools/onos_app.py
@@ -26,6 +26,10 @@ APP_HEADER = '''\
     <description>%(description)s</description>
 '''
 ARTIFACT = '    <artifact>%s</artifact>\n'
+SECURITY = '''\
+    <security>
+%s
+    </security>\n'''
 APP_FOOTER = '</app>'
 
 NON_OSGI_TAG = 'NON-OSGI'
@@ -103,6 +107,7 @@ def generateAppFile(app_name,
                     description = None,
                     apps = [],
                     artifacts = [],
+                    security= None,
                     **kwargs):
     values = {
         'app_name' : app_name,
@@ -123,6 +128,9 @@ def generateAppFile(app_name,
     for artifact in artifacts:
         output += ARTIFACT % mvnUrl(artifact)
 
+    if security is not None:
+        output += SECURITY % security
+
     output += APP_FOOTER
     return output
 
@@ -140,6 +148,7 @@ if __name__ == '__main__':
     parser.add_option("-t", "--title",    dest="title",        help="Title")
     parser.add_option("-r", "--repo",     dest="repo_name",    help="Repo Name")
     parser.add_option('-D', '--desc',     dest='desc',         help='Application description')
+    parser.add_option('-s', '--security', dest='security',     help='Application security')
 
     parser.add_option('-b', '--bundle',
                       action="append", dest='included_bundles',
@@ -206,4 +215,5 @@ if __name__ == '__main__':
     if options.write_app:
         print generateAppFile(artifacts=options.included_bundles,
                               apps=options.apps,
+                              security=options.security,
                               **values)
\ No newline at end of file
diff --git a/bucklets/onos_app.bucklet b/bucklets/onos_app.bucklet
index 14e1d72ae3..193574b5cf 100644
--- a/bucklets/onos_app.bucklet
+++ b/bucklets/onos_app.bucklet
@@ -136,6 +136,7 @@ def onos_app(
         included_bundles = None,
         excluded_bundles = [],
         visibility = [ 'PUBLIC' ],
+        security = None,
         **kwargs):
     if name is None:
         name = _get_name()
@@ -174,6 +175,8 @@ def onos_app(
     args += [ '-d %s' % a for a in required_apps ]
     if description is not None:
         args += [ '-D "%s"' % description ]
+    if security is not None:
+        args += [ '-s "%s"' % security ]
 
     # cmd = '$(exe //buck-tools:onos-app-writer) -F ' + ' '.join(args) + ' > $OUT'
     # genrule(