Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them.
I wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying "potential memory leak here," I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds.
So I built BugZ AI—an open-source vulnerability scanner and automated patching engine.
The Architecture & Stack
To keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack:
Frontend: Next.js (App Router) + Tailwind CSS for a dark-mode, terminal-focused UI.
Backend & Database: Convex. Handling real-time scan state updates and streaming execution logs to the UI without managing WebSockets manually was ridiculously clean with Convex.
Authentication: Clerk for zero-friction user management.
AI Engine: Gemini / OpenAI APIs with structured JSON output enforcement to guarantee valid unified Git patch syntax.
Key Challenge: Generating Valid Git Patches
Getting an LLM to explain a bug is easy. Getting an LLM to generate a syntactically correct .patch file that git apply won't reject is the hard part.
To solve this, the pipeline:
Parses the raw AST / code context.
Prompts the LLM with strict unified diff formatting constraints.
Validates line counts and chunk headers (@@ -line,count +line,count @@) before presenting the patch file in the UI.
How it looks in action
When you import a repo or paste code snippets into BugZ:
It runs a deep security audit looking for async state bugs, unhandled API edge cases, or injection vulnerabilities.
It streams live execution logs directly to your dashboard.
It generates a executable .patch file that you can inspect side-by-side or copy straight to your terminal.
Try it out & Feedback
BugZ is live in early MVP stage right now. I'd love to hear your thoughts, bug reports, or ideas on how to improve the patch syntax generation!
Live Demo: bugz-ai.vercel.app
Stack Highlights: Next.js, Convex, Clerk, Tailwind, AI APIs
Drop your thoughts in the comments below! What SAST tool features do you wish existed in your daily dev workflow?
Top comments (1)
Auto-writing patches can be useful, but the key is ranking and verification. If the system reduces noisy SAST findings into a small set of high-confidence fixes with tests, it helps. If it just creates 200 diffs, the review burden moves instead of shrinking.