# I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches > Source: > Published: 2026-08-11 02:41:05+00:00 Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them. I wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying "potential memory leak here," I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds. So I built BugZ AI—an open-source vulnerability scanner and automated patching engine. The Architecture & Stack To keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack: Frontend: Next.js (App Router) + Tailwind CSS for a dark-mode, terminal-focused UI. Backend & Database: Convex. Handling real-time scan state updates and streaming execution logs to the UI without managing WebSockets manually was ridiculously clean with Convex. Authentication: Clerk for zero-friction user management. AI Engine: Gemini / OpenAI APIs with structured JSON output enforcement to guarantee valid unified Git patch syntax. Key Challenge: Generating Valid Git Patches Getting an LLM to explain a bug is easy. Getting an LLM to generate a syntactically correct .patch file that git apply won't reject is the hard part. To solve this, the pipeline: Parses the raw AST / code context. Prompts the LLM with strict unified diff formatting constraints. Validates line counts and chunk headers (@@ -line,count +line,count @@) before presenting the patch file in the UI. How it looks in action When you import a repo or paste code snippets into BugZ: It runs a deep security audit looking for async state bugs, unhandled API edge cases, or injection vulnerabilities. It streams live execution logs directly to your dashboard. It generates a executable .patch file that you can inspect side-by-side or copy straight to your terminal. Try it out & Feedback BugZ is live in early MVP stage right now. I'd love to hear your thoughts, bug reports, or ideas on how to improve the patch syntax generation! Live Demo: bugz-ai.vercel.app Stack Highlights: Next.js, Convex, Clerk, Tailwind, AI APIs Drop your thoughts in the comments below! What SAST tool features do you wish existed in your daily dev workflow?