I built an AI security scanner that writes Git patches instead of noisy warning logs

If you have ever run a traditional SAST scanner on a codebase, you know the frustration: you get a wall of 150+ warning flags, half are false positives, and none show you how to actually fix the code.

I wanted something faster and more actionable for my own workflow, so I built BugZ.

What it does differently

• Generates .patch files: Instead of just flagging an OWASP vulnerability, it synthesizes the exact Git patch code so you can review and apply the fix immediately.
• Live execution streaming: Uses Convex serverless actions to stream AST analysis logs in real-time.
• GitHub Action support: Runs automated audits directly on Pull Requests.

The Tech Stack

• Frontend: Next.js 14, Tailwind CSS
• Backend: Convex (serverless state & actions)
• AI Engine: Gemini Pro 1.5

It is completely free to try with 5 scans per day and zero signup required: https://bugz-ai.vercel.app

I would love to hear your thoughts, feedback, or ideas for custom SAST rules!