How I built a real-time AI code auditor with Next.js 14, Convex, and Gemini Pro

#ai #webdev #programming #productivity

Hey everyone! 👋

I recently shipped BugZ — an autonomous security auditor that doesn't just flag vulnerabilities, but actually writes the Git .patch file to fix them.

If you’ve ever run a SAST scan, you know the pain of sifting through raw warning logs trying to figure out what to rewrite. I wanted to build something that automated the remediation step.

Here is a quick breakdown of the architecture and how I solved the main technical hurdles.

The Stack

Frontend & Routing: Next.js 14 (App Router)
State & Real-time Database: Convex
Auth: Clerk
AI Engine: Gemini 1.5 Pro

The Challenge: Serverless Timeouts vs. AST Analysis

The hardest part of building BugZ was handling the live terminal UI. When parsing an AST (Abstract Syntax Tree) and running it through an LLM, standard serverless functions often time out or force the user to stare at a loading spinner for 30 seconds.

The Solution: I used Convex subscriptions. Instead of standard polling, the backend processes the AST and pushes real-time execution logs directly to the frontend terminal UI. The user sees exactly what the engine is analyzing line-by-line, eliminating the timeout UX friction.

Auto-Generating the Fix

Once the vulnerabilities are mapped, Gemini 1.5 Pro synthesizes the findings and outputs a clean, unified Git .patch file. You can download it directly from the UI and apply it to your repo in one click.