In this article, the developer of an AI-based document organizing app called Filently shares the experience of the CASA Tier 2 audit that was required for Google OAuth certification. Cost, time required, ZAP preparation process, and the importance of security hygiene are explained in detail, with a particular highlight being the efficient documentation process utilizing Claude Code. In this article, readers will find practical advice and time-saving tips on preparing for a CASA Tier 2 audit.
1. Unexpected CASA Tier 2 Audit Requirements 😮
Valentin Uhrmeister was developing an AI-based document organizing app called Filently, whose core value was the ability to organize documents directly in Google Drive. However, I later found out that in order to access sensitive user data using the Google Drive API, I had to pass Google's CASA (Cloud Application Security Assessment) Tier 2 audit.
"우리는 귀하의 OAuth 확인 서한(LOV)이 구글에 제출되었음을 기쁘게 알려드립니다."
Surprisingly, they say they received OAuth approval from Google just 8 business days after starting the audit. At first I expected it to take a few weeks, but it went much faster than I thought. The author recalls that realizing that this audit was necessary was the hardest part. Since the user's files remain in the cloud and only functions to organize files intelligently, Filently requires permission to read the user's folder structure. Because the app wouldn't work at all without this permission, CASA auditing wasn't just a 'nice-to-have', it was a 'must-have'. 😩
2. Thorough preparation process for audit 🛠️
Before being audited, Valentin ran OWASP ZAP on his app. ZAP is a free, open source tool that finds obvious security vulnerabilities in web applications. He strongly recommended using ZAP for all web apps and emphasized that it is a good habit to build security basics.
"ZAP은 무료 오픈소스이며, 웹 애플리케이션의 명백한 보안 허점을 찾아줄 것입니다. 솔직히, CASA 요구사항이든 아니든 모든 웹 앱에 권장합니다. 보안 기준을 아는 것은 좋은 위생입니다."
Getting ZAP up and running with the CASA setup took longer than expected because the documentation was scattered and some of it was outdated. But in the end, the scan was performed successfully, and the results were 133 PASS, 2 FAIL, 6 WARN.
The two failures discovered were easy to fix.
- X-Powered-By Header: Next.js was exposing its information in every response.
- Proxy Disclosure: Railway was leaking proxy information in the header.
All six warnings were for Missing Security Headers, common things like clickjacking defense, HSTS, and content security policies. He added poweredByHeader: false to his Next.js configuration and moved all security headers to Cloudflare Transform Rules for processing. This is said to be cleaner and more efficient than processing it directly in Next.js because it also applies to static resources.
Hot tip: After fixing the problem, comment out the passed rules in the config file and run the scan again - it goes much faster! 🚀 I couldn't remove Cloudflare's server: cloudflare header, but I resolved all other issues and submitted an audit.
In fact, his preparation went beyond the ZAP scan. This is because the app was built with security in mind from the beginning. They say most of the work had already been completed when the audit began, including GDPR compliance, field-level encryption for personally identifiable information (PII), and proper OAuth token handling. ✨
3. Audit process: $720 and unexpected results 💰
Valentin chose TAC Security, one of the CASA audit organizations selected by Google. He thought he had probably chosen the premium package ($720) which included more support than he needed. The $540 lower tier would have been sufficient if the ZAP scan had been performed and the issues resolved in advance.
The audit began on January 8, and Dynamic Application Security Testing (DAST) scan results came out the next day.
As shown in the picture above, the ESOF cyber score was 9.7 out of 10. A total of 8 items were found: 1 low severity (a previously known Cloudflare header) and 7 informative alerts. One of the informative notices even pointed out that TAC Security itself had an outdated version of ZAP. He opened a support ticket, and within a few hours all issues were 'patched' with no further action required. 👍
4. The power of self-assessment questionnaires (SAQs) and documentation ✍️
A CASA audit does not simply end with vulnerability scanning. You will be asked to complete a Self-Assessment Questionnaire (SAQ) covering 54 security requirements. You'll need to answer a variety of questions, including how you handle user data, what encryption you use, how you manage access control, and what your incident response plan is.
In this process, Valentin used an innovative method that saved a lot of time. We handed over the entire codebase to Claude Code and asked them to document each requirement! 🤖 Claude Code created subagents for various areas including authentication, encryption, rate limiting, and distribution, and created dedicated documentation folders with evidence for each requirement.
This gives me more than just a SAQ answer, I have an actual secure document that I can maintain. Moreover, he built a slash command into Claude Code, which ensured that all code changes were checked against this document. This can flag compliance issues or alert you to documents that need updating. Thanks to this, there is no need to start over from scratch during annual revalidation. What a smart solution! 💡
During this documentation process, I also discovered one thing that was lacking. There was global rate limiting, but there was no route-level rate limiting based on user ID. It was an easily fixable problem, but I hadn't even thought about it until someone asked.
5. From submission to approval: Super fast progress 🚀
Valentin submitted his SAQ on Tuesday, and the next day he received confirmation from TAC Security that everything was ok. We were then asked to provide evidence of how user data was encrypted (screenshots of encrypted database fields and a description of the AES-256-GCM method). A few hours later, I was asked to confirm my application details for submitting a Letter of Validation (LOV), and by the end of the day, the LOV was submitted to Google. And three days later, on Sunday, Google approved OAuth authentication! 🎉
Total time taken was 11 days, actual work days were approximately 8 days. It is said that he worked directly for about 10 to 12 hours, most of which was spent on documentation.
6. Advice to those starting a CASA audit 🎁
Based on his experience, Valentin gave the following advice to those preparing for a CASA audit:
- Run ZAP first. It's free, takes just 20 minutes once you set it up properly, and lets you fix easy problems before you have to pay for an audit.
- Build with security in mind from the beginning. It's important to make security decisions early when dealing with user data, so you don't have to rush to throw in encryption or fix authentication problems later.
- The $540 tier will be sufficient. Once you have completed your ZAP scans, resolved the issues, and prepared your documents, you may not need the additional support of the more expensive premium service.
- Create documentation as you work. Keeping notes on your security choices, such as creating Architecture Decision Records of key decisions, will be of great help when you eventually need them.
- Actual turnaround time may be faster than Google suggests. Google says 4-6 weeks, TAC Security says 1-3 weeks, but in his case it was completed in 8 business days. If your app is already secure, this may end sooner than you expect.
- Make sure you budget for revalidation every year. CASA certification must be renewed annually. Continuous compliance checks using Claude Code will make this process much easier, but it's important to remember that there are still recurring costs.
7. Future plans and ongoing security management 🌟
Philently has now achieved both CASA Tier 2 certification and Google OAuth certification. As planned, the service is scheduled to begin for beta users in January 2026.
The security documents he created will never be left to gather dust. With Claude Code's slash command, every Pull Request (PR) will be checked against compliance requirements, and you won't have to start from scratch when revalidating every year. He shares his journey of building Philently and says he wants to show the actual decision-making process transparently.
"저는 실제 결정을 공유합니다. 하이라이트뿐만이 아니고요."