How I Built an AI Security Auditor That Streams AST Fixes (151 Users in 3 Days)

Static Application Security Testing (SAST) tools often provide extensive logs, flagging OWASP vulnerabilities, but they do not offer immediate fixes. To tackle this issue, I developed BugZ, an autonomous security auditor capable of analyzing code and providing real-time, actionable fixes. 🛠️

The core functionality of BugZ is to parse Abstract Syntax Tree (AST) nodes and stream real-time reasoning directly to the user interface. Once a flaw is identified, BugZ automatically generates a downloadable Git .patch file, enabling instant code fixes. To apply the fix, users can execute a single command: `git apply security-fix.patch`. ⚡

The development stack comprises Next.js 14 (App Router) with Tailwind CSS for the frontend, Convex for database management and real-time state synchronization, and Gemini Pro as the AI engine. Early traction was achieved within the first three days, with 151 unique visitors/users, 3 GitHub stars, and no advertising spend required. 💰

Key lessons learned during the solo development process include the importance of streaming UI, which involves fine-tuning Server-Sent Events (SSE) alongside React Suspense boundaries to maintain low latency. Convex proved to be instrumental in synchronizing live AST execution states between the parsing engine and the client seamlessly. 🔗

To experience BugZ and provide feedback, users can visit bugz-ai.vercel.app. The author is eager to receive your thoughts on the UI/UX and suggestions for future feature enhancements.