Licensing

PEART is licensed in two layers, because code and content are different things. This page is a reader-facing summary, not legal advice; the LICENSE files in the repository are authoritative.

Code: AGPL-3.0-only

The Go code is licensed AGPL-3.0-only. In practice this means: if you run a modified PEART as a network service, you must offer the corresponding source. It does not forbid commercial use, self-hosting, running an unmodified copy as a service, or paid consulting that uses the tool. It is the realistic protection for a tool meant to stay open and auditable: modifications offered over the network stay open, and everything else is allowed.

Content: CC-BY-SA-4.0

The technique and methodology content authored for PEART is licensed CC-BY-SA-4.0. You may use it commercially; sharing it or an adaptation requires attribution and the same licence. Using the methodology internally does not oblige you to publish your reports or findings.

Catalogue provenance

The catalogues reference external standards, each under its own licence, recorded with attribution and provenance in LICENSE-CATALOGS:

• OWASP WSTG 4.2 and OWASP ASVS 5.0.0 are CC-BY-SA-4.0, attributed with a note of modifications.
• MITRE CWE identifiers are referenced, not reproduced.
• The CWE-to-NIST crosswalk is PEART's own work-product, licensed CC-BY-4.0, more permissive than the technique content on purpose, since it maps public-domain NIST identifiers and MITRE CWE ids and carries no share-alike obligation.
• The vendored front-end packages keep their own licences (BSD-3-Clause, MIT), listed in the SBOM.

How the layers are kept separate

Code and content live in separate directories, each with its own licence file, and carry SPDX headers (AGPL-3.0-only on code, the CC identifier on content). This is what lets one repository hold both licences cleanly, and what lets a report cite exactly which standard and version each mapping came from.