How I built a real-time AI code auditor with Next.js 14, Convex, and Gemini Pro

Kien Tran — Thu, 06 Aug 2026 07:15:12 +0000

Hey everyone! 👋

I recently shipped BugZ — an autonomous security auditor that doesn't just flag vulnerabilities, but actually writes the Git .patch file to fix them.

If you’ve ever run a SAST scan, you know the pain of sifting through raw warning logs trying to figure out what to rewrite. I wanted to build something that automated the remediation step.

Here is a quick breakdown of the architecture and how I solved the main technical hurdles.

The Stack

Frontend & Routing: Next.js 14 (App Router)
State & Real-time Database: Convex
Auth: Clerk
AI Engine: Gemini 1.5 Pro

The Challenge: Serverless Timeouts vs. AST Analysis

The hardest part of building BugZ was handling the live terminal UI. When parsing an AST (Abstract Syntax Tree) and running it through an LLM, standard serverless functions often time out or force the user to stare at a loading spinner for 30 seconds.

The Solution: I used Convex subscriptions. Instead of standard polling, the backend processes the AST and pushes real-time execution logs directly to the frontend terminal UI. The user sees exactly what the engine is analyzing line-by-line, eliminating the timeout UX friction.

Auto-Generating the Fix

Once the vulnerabilities are mapped, Gemini 1.5 Pro synthesizes the findings and outputs a clean, unified Git .patch file. You can download it directly from the UI and apply it to your repo in one click.

Try it out

BugZ is completely free to run (5 free daily scans) and takes about 30 seconds to run a full audit.

🔗 Live App: https://bugz-ai.vercel.app

I’d love for some folks to test a scan on your repos and share feedback on how the patch generator performs on edge cases!

I built an AI security scanner that writes Git patches instead of noisy warning logs

Kien Tran — Wed, 05 Aug 2026 03:47:49 +0000

If you have ever run a traditional SAST scanner on a codebase, you know the frustration: you get a wall of 150+ warning flags, half are false positives, and none show you how to actually fix the code.

I wanted something faster and more actionable for my own workflow, so I built BugZ.

What it does differently

Generates .patch files: Instead of just flagging an OWASP vulnerability, it synthesizes the exact Git patch code so you can review and apply the fix immediately.
Live execution streaming: Uses Convex serverless actions to stream AST analysis logs in real-time.
GitHub Action support: Runs automated audits directly on Pull Requests.

The Tech Stack

Frontend: Next.js 14, Tailwind CSS
Backend: Convex (serverless state & actions)
AI Engine: Gemini Pro 1.5

It is completely free to try with 5 scans per day and zero signup required: https://bugz-ai.vercel.app

I would love to hear your thoughts, feedback, or ideas for custom SAST rules!

DEV Community: Kien Tran