DEV Community: Kien Tran

Stop Sending Devs 80-Page Security Reports: The Case for Autonomous Remediation

Kien Tran — Sun, 16 Aug 2026 01:19:27 +0000

Traditional application security tooling is built on an outdated assumption: that engineers have endless bandwidth to parse 80-page vulnerability scan reports.

In high-velocity engineering teams, static analysis reports often become shelfware. Security teams flag high-severity issues, development teams push back due to tight sprint deadlines, and the remediation backlog compounds.

The friction isn't identifying the vulnerability—it's drafting, testing, and applying the fix without breaking existing business logic.

The Flaw in the Modern AppSec Loop

When a security scanner flags an issue, the current workflow looks like this:

Scanner outputs: "Unsafe object assignment at line 142."
An engineer reads the alert, opens the file, and reviews the surrounding call graph.
The engineer writes boilerplate guard clauses.
The engineer submits a PR, waits for review, and manually tests for regressions.

This cycle takes hours or days per vulnerability. Multiplied across hundreds of microservices, remediation velocity drops to near zero.

Shifting from Passive Alerts to Git Patches

BugZ was built to eliminate this triage friction by shifting from passive advisory to active resolution. Instead of handing engineers a generic advisory, it analyzes the codebase and directly synthesizes a precise Git .patch file.
The future of software security isn't telling developers what went wrong—it's handing them the verified solution.

Direct Remediation: Replaces abstract vulnerability advice with functional, commit-ready diffs.
Frictionless Review: Engineers inspect the exact patch changes via standard Git tooling before applying.
Velocity Preservation: Security fixes move from multi-day triage items to one-click pull request reviews.


bash
# Review and apply the synthesized fix directly
git apply bugz-remediation.patch

How We Built an Instant AI Security & Code Auditor in Next.js & Convex

Kien Tran — Fri, 14 Aug 2026 03:07:44 +0000

🚀 How We Built an Instant AI Security & Code Auditor in Next.js & Convex

When building security or code auditing tools, speed is everything. Developers won't wait 45 seconds for a bloated PDF report—they want instant feedback on potential bugs, security leaks, or bad practices.

Over the last week, we've been building BugZ AI, a lightweight scanner designed to analyze code repos and security links in under 5 seconds.

Here is a breakdown of our stack and the architecture choices behind keeping real-time scans ultra-fast.

💡 Build in Public Update: We hit 175 total developer visits today on Day 4 of building out in the open!

🛠️ 1. The Tech Stack

Frontend: Next.js 15 (App Router) + Tailwind CSS
Backend & Database: Convex (for real-time reactive updates without manual polling)
Auth: Clerk
Mobile Sync: Capacitor (wrapping web assets into native Android)

⚡ 2. Solving the Speed Bottleneck

The biggest challenge was stream handling. Instead of waiting for the entire LLM response to complete before rendering analysis to the UI, we used Convex's real-time mutations paired with edge streaming.

This lets the user paste a link or snippet and see initial vulnerability checks pop up in real-time within < 20 seconds.

📈 3. What We Learned Building Out in the Open

Keep the UI distraction-free: Developers hate bloated dashboards when a single search bar will do the job.
Real-time > Batch: Showing progress indicators reduces drop-off rates significantly compared to static loader spinners.

🧪 Try it out & Drop Your Feedback!

If you want to run a quick audit on your project or test a link, check out the live demo here: [INSERT YOUR BUGZ AI LINK HERE]

I'd love to hear your feedback on the scanning speed and response accuracy. What features would make this a daily part of your dev workflow?

"Dev Log #1: Crossing 150+ Users on BugZ (Lessons from 3 Days of Shipping)

Kien Tran — Thu, 13 Aug 2026 02:47:22 +0000

Quick milestone update: BugZ (an autonomous AI security auditor) just hit 156 users overnight!

Building this solo with Next.js 14, Convex, and Gemini Pro has been an awesome experiment in real-time AST parsing and auto-generating Git .patch files.

💡 Key Takeaway from Early Community Feedback

After posting our first breakdown on Dev.to yesterday, senior devs dropped great insights on patch validation boundaries—specifically running generated diffs in disposable checkouts against test suites before showing them to the user.

🚀 What's Next

Adding rule ID & exact source span tracking to generated patches.
Fine-tuning real-time streaming latency for larger repos.

Try running a quick security audit on your repositories:
👉 bugz-ai.vercel.app

Got feedback or want to roast the UI? Drop a comment below! 👇

How I Built an AI Security Auditor That Streams AST Fixes (151 Users in 3 Days)

Kien Tran — Wed, 12 Aug 2026 03:11:33 +0000

Most Static Application Security Testing (SAST) tools give you a massive wall of text. They flag OWASP vulnerabilities, but leave you searching line-by-line to manually apply fixes.

To solve this, I spent the last few weeks building BugZ—an autonomous security auditor designed to analyze code and generate immediate, actionable fixes.

🛠️ The Core Concept & How It Works

Instead of dumping static logs, BugZ parses AST nodes and streams real-time reasoning directly to the UI. Once a flaw is detected, it auto-generates a downloadable Git .patch file so you can fix your code instantly.

# Apply a fix generated by BugZ in one command
git apply security-fix.patch

⚡ The Tech Stack

Frontend: Next.js 14 (App Router) + Tailwind CSS
Database & Real-Time State: Convex
AI Engine: Gemini Pro

🚀 Early Traction (First 3 Days)

Building in public and focusing on a genuine developer pain point brought in awesome early validation:

📈 151 unique visitors/users
⭐ 3 GitHub stars
💰 $0 spent on ads

💡 What I Learned Building Solo

Streaming UI is Essential: Handling real-time AST parsing streams directly to the frontend required fine-tuning Server-Sent Events (SSE) alongside React Suspense boundaries to keep latency low.
Convex for Live State Sync: Instead of polling a traditional REST DB, Convex made syncing live AST execution states between the parser engine and the client seamless.

🔗 Try It Out & Give Feedback

Run a free audit on your repositories:
👉 bugz-ai.vercel.app

I'd love your feedback! Test it on your repos, roast the UI/UX, or let me know what features you'd like to see next in the comments below! 👇

[Boost]

Kien Tran — Tue, 11 Aug 2026 02:41:30 +0000

Kien Tran

Aug 11

I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches

#ai #webdev #programming #productivity

2 min read

I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches

Kien Tran — Tue, 11 Aug 2026 02:41:05 +0000

Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them.

I wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying "potential memory leak here," I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds.

So I built BugZ AI—an open-source vulnerability scanner and automated patching engine.

The Architecture & Stack
To keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack:

Frontend: Next.js (App Router) + Tailwind CSS for a dark-mode, terminal-focused UI.

Backend & Database: Convex. Handling real-time scan state updates and streaming execution logs to the UI without managing WebSockets manually was ridiculously clean with Convex.

Authentication: Clerk for zero-friction user management.

AI Engine: Gemini / OpenAI APIs with structured JSON output enforcement to guarantee valid unified Git patch syntax.

Key Challenge: Generating Valid Git Patches
Getting an LLM to explain a bug is easy. Getting an LLM to generate a syntactically correct .patch file that git apply won't reject is the hard part.

To solve this, the pipeline:

Parses the raw AST / code context.

Prompts the LLM with strict unified diff formatting constraints.

Validates line counts and chunk headers (@@ -line,count +line,count @@) before presenting the patch file in the UI.

How it looks in action
When you import a repo or paste code snippets into BugZ:

It runs a deep security audit looking for async state bugs, unhandled API edge cases, or injection vulnerabilities.

It streams live execution logs directly to your dashboard.

It generates a executable .patch file that you can inspect side-by-side or copy straight to your terminal.

Try it out & Feedback
BugZ is live in early MVP stage right now. I'd love to hear your thoughts, bug reports, or ideas on how to improve the patch syntax generation!

Live Demo: bugz-ai.vercel.app

Stack Highlights: Next.js, Convex, Clerk, Tailwind, AI APIs

Drop your thoughts in the comments below! What SAST tool features do you wish existed in your daily dev workflow?

How I built a real-time AI code auditor with Next.js 14, Convex, and Gemini Pro

Kien Tran — Thu, 06 Aug 2026 07:15:12 +0000

Hey everyone! 👋

I recently shipped BugZ — an autonomous security auditor that doesn't just flag vulnerabilities, but actually writes the Git .patch file to fix them.

If you’ve ever run a SAST scan, you know the pain of sifting through raw warning logs trying to figure out what to rewrite. I wanted to build something that automated the remediation step.

Here is a quick breakdown of the architecture and how I solved the main technical hurdles.

The Stack

Frontend & Routing: Next.js 14 (App Router)
State & Real-time Database: Convex
Auth: Clerk
AI Engine: Gemini 1.5 Pro

The Challenge: Serverless Timeouts vs. AST Analysis

The hardest part of building BugZ was handling the live terminal UI. When parsing an AST (Abstract Syntax Tree) and running it through an LLM, standard serverless functions often time out or force the user to stare at a loading spinner for 30 seconds.

The Solution: I used Convex subscriptions. Instead of standard polling, the backend processes the AST and pushes real-time execution logs directly to the frontend terminal UI. The user sees exactly what the engine is analyzing line-by-line, eliminating the timeout UX friction.

Auto-Generating the Fix

Once the vulnerabilities are mapped, Gemini 1.5 Pro synthesizes the findings and outputs a clean, unified Git .patch file. You can download it directly from the UI and apply it to your repo in one click.

Try it out

BugZ is completely free to run (5 free daily scans) and takes about 30 seconds to run a full audit.

🔗 Live App: https://bugz-ai.vercel.app

I’d love for some folks to test a scan on your repos and share feedback on how the patch generator performs on edge cases!

I built an AI security scanner that writes Git patches instead of noisy warning logs

Kien Tran — Wed, 05 Aug 2026 03:47:49 +0000

If you have ever run a traditional SAST scanner on a codebase, you know the frustration: you get a wall of 150+ warning flags, half are false positives, and none show you how to actually fix the code.

I wanted something faster and more actionable for my own workflow, so I built BugZ.

What it does differently

Generates .patch files: Instead of just flagging an OWASP vulnerability, it synthesizes the exact Git patch code so you can review and apply the fix immediately.
Live execution streaming: Uses Convex serverless actions to stream AST analysis logs in real-time.
GitHub Action support: Runs automated audits directly on Pull Requests.

The Tech Stack

Frontend: Next.js 14, Tailwind CSS
Backend: Convex (serverless state & actions)
AI Engine: Gemini Pro 1.5

It is completely free to try with 5 scans per day and zero signup required: https://bugz-ai.vercel.app

I would love to hear your thoughts, feedback, or ideas for custom SAST rules!