{"slug": "i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes", "title": "I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches", "summary": "A developer built BugZ AI, an open-source vulnerability scanner and automated patching engine that generates exact Git patch files to fix security issues. The tool uses Next.js, Convex, Clerk, and AI APIs from Gemini and OpenAI to validate and produce syntactically correct patches, reducing noise from traditional SAST tools. The MVP is live at bugz-ai.vercel.app.", "body_md": "Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them.\n\nI wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying \"potential memory leak here,\" I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds.\n\nSo I built BugZ AI—an open-source vulnerability scanner and automated patching engine.\n\nThe Architecture & Stack\n\nTo keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack:\n\nFrontend: Next.js (App Router) + Tailwind CSS for a dark-mode, terminal-focused UI.\n\nBackend & Database: Convex. Handling real-time scan state updates and streaming execution logs to the UI without managing WebSockets manually was ridiculously clean with Convex.\n\nAuthentication: Clerk for zero-friction user management.\n\nAI Engine: Gemini / OpenAI APIs with structured JSON output enforcement to guarantee valid unified Git patch syntax.\n\nKey Challenge: Generating Valid Git Patches\n\nGetting an LLM to explain a bug is easy. Getting an LLM to generate a syntactically correct .patch file that git apply won't reject is the hard part.\n\nTo solve this, the pipeline:\n\nParses the raw AST / code context.\n\nPrompts the LLM with strict unified diff formatting constraints.\n\nValidates line counts and chunk headers (@@ -line,count +line,count @@) before presenting the patch file in the UI.\n\nHow it looks in action\n\nWhen you import a repo or paste code snippets into BugZ:\n\nIt runs a deep security audit looking for async state bugs, unhandled API edge cases, or injection vulnerabilities.\n\nIt streams live execution logs directly to your dashboard.\n\nIt generates a executable .patch file that you can inspect side-by-side or copy straight to your terminal.\n\nTry it out & Feedback\n\nBugZ is live in early MVP stage right now. I'd love to hear your thoughts, bug reports, or ideas on how to improve the patch syntax generation!\n\nLive Demo: bugz-ai.vercel.app\n\nStack Highlights: Next.js, Convex, Clerk, Tailwind, AI APIs\n\nDrop your thoughts in the comments below! What SAST tool features do you wish existed in your daily dev workflow?", "url": "https://wpnews.pro/news/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes", "canonical_source": "https://dev.to/kientndev/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes-git-patches-1i80", "published_at": "2026-08-11 02:41:05+00:00", "updated_at": "2026-08-11 03:15:49.578569+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["BugZ AI", "SonarQube", "Snyk", "Next.js", "Convex", "Clerk", "Gemini", "OpenAI"], "alternates": {"html": "https://wpnews.pro/news/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes", "markdown": "https://wpnews.pro/news/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes.md", "text": "https://wpnews.pro/news/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes.txt", "jsonld": "https://wpnews.pro/news/i-got-tired-of-200-noisy-sast-alerts-so-i-built-an-ai-engine-that-auto-writes.jsonld"}}