diff --git a/src/main/aem/jcr_root/apps/cq/.content.xml b/src/main/aem/jcr_root/apps/cq/.content.xml
new file mode 100644
index 0000000..f7fac5e
--- /dev/null
+++ b/src/main/aem/jcr_root/apps/cq/.content.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <gui/>
+    <core/>
+</jcr:root>
diff --git a/src/main/aem/jcr_root/apps/cq/core/.content.xml b/src/main/aem/jcr_root/apps/cq/core/.content.xml
new file mode 100644
index 0000000..c332cfb
--- /dev/null
+++ b/src/main/aem/jcr_root/apps/cq/core/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <content/>
+</jcr:root>
diff --git a/src/main/aem/jcr_root/apps/cq/core/content/.content.xml b/src/main/aem/jcr_root/apps/cq/core/content/.content.xml
new file mode 100644
index 0000000..72353bf
--- /dev/null
+++ b/src/main/aem/jcr_root/apps/cq/core/content/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <nav/>
+</jcr:root>
diff --git a/src/main/aem/jcr_root/apps/cq/core/content/nav/.content.xml b/src/main/aem/jcr_root/apps/cq/core/content/nav/.content.xml
new file mode 100644
index 0000000..8a2ae35
--- /dev/null
+++ b/src/main/aem/jcr_root/apps/cq/core/content/nav/.content.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+          xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
+          jcr:primaryType="nt:unstructured">
+    <tools jcr:primaryType="nt:unstructured">
+        <security
+            jcr:primaryType="nt:unstructured"
+            jcr:title="Security"
+            id="cq-tools-security">
+            <secureAem jcr:primaryType="nt:unstructured"
+                jcr:title="Secure AEM"
+                jcr:description="Check security of your infrastructure"
+                href="/etc/secureaem.html"
+                icon="globeCheck"
+                id="secureaem"/>
+        </security>
+    </tools>
+</jcr:root>
diff --git a/src/main/vault/full/filter.xml b/src/main/vault/full/filter.xml
index f6a3dbe..a0645d3 100644
--- a/src/main/vault/full/filter.xml
+++ b/src/main/vault/full/filter.xml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <workspaceFilter version="1.0">
 	<filter root="/apps/cognifide/secureaem"/>
+	<filter root="/apps/cq/core/content/nav/tools/security/secureAem"/>
 	<filter root="/apps/cognifide/install">
 		<include pattern="/apps/cognifide/install/secure-aem.*"/>
 	</filter>