Proposing a technique or methodology

The technique and methodology catalogues are data, not code, and they are what a report ultimately derives from, so a contribution to them goes through the same discipline as any catalogue content.

The shape

A new technique is an entry in a technique catalogue, with its objective, procedure, expected evidence, secure behaviour, remediation, references and its mappings (WSTG, ASVS, CWE). A new methodology is an ordered set of steps linking techniques. Follow the Catalog YAML format; the files in the repository are the working examples.

Provenance and licence are part of the contribution

Because the catalogues declare their own provenance and licence, a contribution has to say where its content comes from and under what terms. Content authored for PEART is CC-BY-SA-4.0; content that references or adapts an external standard (OWASP, MITRE) must carry the attribution and version, and note that it was modified. A mapping is a fact you can cite, not a guess: link the technique to the standard's real identifier, at the version the catalogue declares.

What makes a good mapping

The mappings are the highest-value part, because everything downstream (a finding's mappings, the compliance crosswalk) derives from them. A mapping should be defensible without discussion: the WSTG or ASVS item that genuinely covers the technique, the CWE that genuinely names the weakness. A loose or aspirational mapping is worse than none, because a wrong code undermines the auditor's trust in the whole report. When a technique has no clean mapping to a standard, leave it unmapped rather than forcing one.