Architecture at a glance

Two binaries, three processes

PEART is two Go binaries. peart serves the internal surface the pentester uses; peart-portal serves the portal the client uses, which reads what has been published and writes only the session and the client's fix declaration. They are separate binaries, not one with a flag, so the portal process cannot reach an internal handler even by accident. A third process, the rendering sidecar, turns report HTML into PDF with WeasyPrint, isolated with no network and no access to the database, the key or the evidence.

Serving each API and its interface from the same address is deliberate: it removes cross-origin requests, which lets the session cookie be strict SameSite without CORS. The trust boundary that matters is not API versus interface, it is peart versus peart-portal.

Data

State lives in a single SQLite database. Evidence and backups are encrypted at the file level with age; the database itself is cleartext by decision, with full-disk encryption on the host as the compensating control. The technique and methodology catalogues are embedded in the binary, so the tool carries its own reference data and runs offline. Schema changes are forward-only migrations, and the process refuses to start against an outdated database rather than migrating silently at boot.

Front end

The interface is a multi-page application: one static page per route, served from the binary by go:embed, with no build step and no Node in the release. Components are Lit in light DOM. The Content-Security-Policy carries no unsafe-inline and no unsafe-eval, and the project's own code contains no innerHTML or unsafeHTML, so hostile content can be stored and displayed without ever being executed.

Supply chain

Releases are cross-compiled pure Go, signed keyless with cosign and published with a CycloneDX SBOM that covers both the Go modules and the vendored front-end. Every commit runs the same gates CI enforces (gosec, gitleaks, govulncheck, and the rest), so the security posture is checked continuously, not only at release. The Security and compliance section covers all of this in depth.