How I Built an AI Security Auditor That Streams AST Fixes (151 Users in 3 Days)

Most Static Application Security Testing (SAST) tools give you a massive wall of text. They flag OWASP vulnerabilities, but leave you searching line-by-line to manually apply fixes.

To solve this, I spent the last few weeks building BugZ—an autonomous security auditor designed to analyze code and generate immediate, actionable fixes.

🛠️ The Core Concept & How It Works

Instead of dumping static logs, BugZ parses AST nodes and streams real-time reasoning directly to the UI. Once a flaw is detected, it auto-generates a downloadable Git .patch file so you can fix your code instantly.

# Apply a fix generated by BugZ in one command
git apply security-fix.patch

Enter fullscreen mode Exit fullscreen mode

⚡ The Tech Stack

• Frontend: Next.js 14 (App Router) + Tailwind CSS
• Database & Real-Time State: Convex
• AI Engine: Gemini Pro

🚀 Early Traction (First 3 Days)

Building in public and focusing on a genuine developer pain point brought in awesome early validation:

• 📈 151 unique visitors/users
• ⭐ 3 GitHub stars
• 💰 $0 spent on ads

💡 What I Learned Building Solo

1. Streaming UI is Essential: Handling real-time AST parsing streams directly to the frontend required fine-tuning Server-Sent Events (SSE) alongside React Suspense boundaries to keep latency low.
2. Convex for Live State Sync: Instead of polling a traditional REST DB, Convex made syncing live AST execution states between the parser engine and the client seamless.

🔗 Try It Out & Give Feedback

Run a free audit on your repositories:
👉 bugz-ai.vercel.app

I’d love your feedback! Test it on your repos, roast the UI/UX, or let me know what features you’d like to see next in the comments below! 👇