Philosophy

A handful of principles decide the trade-offs in PEART. They are worth reading once, because they explain choices that would otherwise look arbitrary.

Self-hosted and offline

Everything PEART holds lives on the operator's own host. The catalogues are embedded in the binary, so it runs in an isolated network with no external dependency at runtime, and it phones home to no one. For a tool that stores a consultancy's clients' unfixed vulnerabilities, "your data never leaves your host" is not a feature bolted on, it is the starting assumption everything else is built around.

Simple over clever

PEART prefers the direct, auditable solution to the clever one. Two static Go binaries with no CGO, a single SQLite database, front-end components with no build step, forward-only migrations. The payoff is that the whole system can be read and reasoned about, which for a security product is not a nicety: you cannot trust what you cannot audit, and simplicity is what keeps it auditable.

Secure by default, and honest about the edges

PEART refuses unsafe configuration rather than falling back to a convenient default, treats every text field as hostile input, and separates its surfaces so that compromising the internet-facing one does not reach the evidence or the key. And where it does not protect something (the database is cleartext, the host operator is trusted), it says so plainly. A declared limitation is worth more than a vague promise, because the reader can reason about the residual risk instead of trusting a guarantee that does not hold.

Relate, do not certify

The compliance mapping relates a finding to a control; it never certifies compliance. The tool gives the auditor the correlational map they would otherwise build by hand, and leaves the conclusion to them. The same instinct runs through the reporting: state exactly what is true, with its provenance, and let the reader trust it because it is not inflated.

Open source, corporate quality

Being open source is not a reason to be less rigorous. The signed, attested releases, the security gates that run on every commit, the threat model written down and kept honest, are the same standard a closed enterprise product would be held to. The source being public is what lets anyone check that the standard is real.