So it’s not really clear to me when I should add the security module into a project. Should I do this before I start adding applications or when I’m all done?
That doesn’t matter. If you generate the security it will set the security option of all applications to on (you need to uncheck your logon app) and generate the applications. Afterwards when you still add applications there’s a function to synchronize. So actually, it doesn’t matter.