Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them.
I wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying "potential memory leak here," I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds.
So I built BugZ AI—an open-source vulnerability scanner and automated patching engine.
The Architecture & Stack
To keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack:
Frontend: Next.js (App Router) + Tailwind CSS for a dark-mode, terminal-focused UI.
Backend & Database: Convex. Handling real-time scan state updates and streaming execution logs to the UI without managing WebSockets manually was ridiculously clean with Convex.
Authentication: Clerk for zero-friction user management.
AI Engine: Gemini / OpenAI APIs with structured JSON output enforcement to guarantee valid unified Git patch syntax.
Key Challenge: Generating Valid Git Patches
Getting an LLM to explain a bug is easy. Getting an LLM to generate a syntactically correct .patch file that git apply won't reject is the hard part.
To solve this, the pipeline:
Parses the raw AST / code context.
Prompts the LLM with strict unified diff formatting constraints.
Validates line counts and chunk headers (@@ -line,count +line,count @@) before presenting the patch file in the UI.
How it looks in action
When you import a repo or paste code snippets into BugZ:
It runs a deep security audit looking for async state bugs, unhandled API edge cases, or injection vulnerabilities.
It streams live execution logs directly to your dashboard.
It generates a executable .patch file that you can inspect side-by-side or copy straight to your terminal.
Try it out & Feedback
BugZ is live in early MVP stage right now. I'd love to hear your thoughts, bug reports, or ideas on how to improve the patch syntax generation!
Live Demo: bugz-ai.vercel.app
Stack Highlights: Next.js, Convex, Clerk, Tailwind, AI APIs
Drop your thoughts in the comments below! What SAST tool features do you wish existed in your daily dev workflow?
Top comments (4)
Auto-writing patches can be useful, but the key is ranking and verification. If the system reduces noisy SAST findings into a small set of high-confidence fixes with tests, it helps. If it just creates 200 diffs, the review burden moves instead of shrinking.
Spot on, Alex. Shifting 200 SAST warnings into 200 unverified diffs just changes the flavor of developer fatigue.
The core focus with BugZ is filtering and ranking the noise before patch synthesis—grouping vulnerabilities by AST context, prioritizing exploitability, and generating patches for high-confidence findings rather than spraying diffs across every minor warning. Adding automated test execution to verify patches before outputting them is definitely on the roadmap for that exact reason.
Appreciate the feedback! If you have a repo or noisy SAST benchmark you'd want to test it against, I'd love to hear how the confidence filtering holds up for your workflow
That ranking-first approach is exactly where I would put the leverage. A smaller set of high-confidence diffs plus proof is much easier to trust than a huge patch stream. One practical benchmark I would like is "warnings closed without new tests" versus "warnings closed with a failing repro first"; that separates patch generation from actual security regression reduction.
That ranking-first approach is the right way to avoid turning SAST noise into patch noise. I would be especially interested in the benchmark where a generated fix passes tests but changes the security property in the wrong direction.