CheckMate App is the native cross-platform desktop application for the CheckMate security ecosystem. Designed for security analysts, leads, and developers, it delivers a high-density, executive-level dashboard to analyze secret exposure posture across codebases, repositories, and organizational workspaces.
Unlike traditional flat security scanners, CheckMate App correlates findings across projects to identify reused credentials, classify production vs. non-production leaks, compute highest-ROI remediation priorities, and track multi-scan posture trends.
- 📊 Executive & Analyst Dashboard: Unified security posture rating (0–100%) with real-time workspace and environment filtering.
- 🤖 Bring Your Own AI (BYO AI) Auto-Triage: Connect local LLMs (Ollama) or cloud models (OpenAI, Anthropic, DeepSeek) for automated finding analysis, false positive likelihood scoring, and auto-suppression with persistent human-in-the-loop override memory.
- 🔑 Cross-Project Reused Secrets Inventory: Detects secret keys reused across multiple repositories to mitigate lateral movement risk.
- 🎯 Highest ROI Remediation Playbook: Ranks top 5 actions that yield the largest percentage reduction in exposure (e.g. rotating 1 reused secret key eliminates 14 leak instances).
- 🧪 Production vs. Non-Production Risk Profiling: Heuristically classifies leaks in live code vs. test suites, mocks, and fixtures.
- 📈 Multi-Scan Posture Trends: Custom interactive SVG trend charts tracking critical and high findings over historical scan executions.
- 🔄 In-App Auto-Update Checking: Built-in release detection that notifies analysts when a new version is available on GitHub Releases.
CheckMate App includes a privacy-first BYO AI Triage Engine that eliminates alert fatigue without compromising code confidentiality.
- Multi-Provider Support: Connect your choice of AI provider:
- 🦙 Ollama (Local, air-gapped LLMs like
llama3,mistral,codellama— zero code leaves your machine) - 🧠 OpenAI (
gpt-4o,gpt-4-turbo) - 🤖 Anthropic (
claude-3-5-sonnet,claude-3-haiku) - ⚡ DeepSeek (
deepseek-chat,deepseek-coder) - 🔌 Custom OpenAI-Compatible Endpoints (vLLM, LocalAI, LM Studio)
- 🦙 Ollama (Local, air-gapped LLMs like
- Automated Triage & Confidence Thresholding: Analyzes finding entropy, structural context, and code evidence. When a finding exceeds your configured confidence threshold (e.g.,
fpLikelihood >= 80%), CheckMate automatically creates an exception record and suppresses the finding. - Privacy & Prompt Redaction: Choose between
REDACTEDmode (masks sensitive credentials before sending to LLM) orFULLcontext mode. - Human-in-the-Loop & Decision Memory:
- Analysts can view detailed AI annotations, confidence scores, and reasoning summaries in the finding detail drawer.
- If an analyst marks a finding as "True Positive" or deletes an AI-generated suppression, CheckMate flags the finding with
UserOverridden = true. - CheckMate's persistent database remembers your decision across future scan runs: the AI engine will NEVER re-suppress a user-confirmed finding on subsequent scans.
brew install --cask adedayo/tap/checkmate-appNote
macOS Gatekeeper. CheckMate is free open-source software and is not code-signed with a paid Apple Developer certificate — we are not going to charge the community, however indirectly, to fund a $99/year rent to Apple. The Homebrew cask above verifies the download's SHA-256 and clears the quarantine flag for you, so this route needs no workaround.
If you download the .dmg directly, macOS will say Apple "cannot check it".
Verify it yourself against SHA256SUMS (see
docs/distribution.md), then clear the flag on that
one app:
xattr -dr com.apple.quarantine /Applications/CheckMate.appThat is scoped to this app. Do not run spctl --master-disable, which
disables Gatekeeper for everything you will ever download. Right-clicking the
app in Finder and choosing Open achieves the same per-app exception.
Download the latest .dmg or .zip release from GitHub Releases.
Download and run CheckMate-amd64-installer.exe from GitHub Releases.
winget install adedayo.checkmate-appDownload the Linux package from GitHub Releases:
# Extract the binary
tar -xzvf CheckMate-linux-amd64.tar.gz
# Run the app
./CheckMateRun CheckMate App in headless/web mode with a single command:
docker run -d \
--name checkmate-app \
-p 8080:8080 \
-v ~/.checkmate:/root/.checkmate \
ghcr.io/adedayo/checkmate-app:latestAccess the UI in your browser at http://localhost:8080.
Alternatively, launch using Docker Compose:
version: '3.8'
services:
checkmate-app:
image: ghcr.io/adedayo/checkmate-app:latest
container_name: checkmate-app
ports:
- "8080:8080"
volumes:
- ~/.checkmate:/root/.checkmatedocker compose up -dCheckMate App automatically checks the GitHub Releases on startup. When a new release is published:
- An Update Ready Banner appears at the top of the Executive Dashboard.
- Displays the version jump (e.g.,
v2.1.0➔v2.2.0) and release notes summary. - Provides a 1-click Get Update button linking directly to the release package.
Automated multi-platform builds (macOS DMG, Windows EXE, Linux packages, Docker images) are governed by GitHub Actions (.github/workflows/release.yml).
To trigger an automated release:
# Run the automated release orchestration script
./scripts/release.sh v2.1.0This script will:
- Validate semver formatting (
v2.1.0). - Update
AppVersioninapp.go. - Verify Angular frontend & Go backend compilation.
- Commit the version bump and create a git tag (
v2.1.0). - Push tag to
origin, triggering the GitHub Actions matrix build.
- Go:
1.24+ - Node.js:
22+&npm - Wails CLI:
go install github.com/wailsapp/wails/v2/cmd/wails@latest
# Clone checkmate-app repository
git clone https://github.com/adedayo/checkmate-app.git
cd checkmate-app
# Launch Wails development environment (Hot Reloading)
wails devCheckMate App is open-source software licensed under the BSD 3-Clause License.