I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches

Traditional security tools like SonarQube or Snyk are great at one thing: throwing a wall of 200 warnings at you, half of which are false positives, and leaving you to figure out how to manually fix them.

I wanted a faster, more actionable security workflow for my own projects. Instead of just flagging a line number and saying "potential memory leak here," I wanted a tool that synthesizes an exact .patch diff file I can review and apply in seconds.

So I built BugZ AI—an open-source vulnerability scanner and automated patching engine.

The Architecture & Stack

To keep the UI real-time and snappy while LLMs crunch through repository files, I used this stack:

I got tired of 200 noisy SAST alerts, so I built an AI engine that auto-writes Git patches

Related reading

I was tired of security scanners with 90% false positives, so I built my own

I Built a 100% Offline SAST Scanner That Finds What Semgrep and CodeQL Miss

I built a security scanner for AI-generated code — here's what it found

DevGuard AI: A Self-Observing Multi-Agent Security Pipeline Built on SigNoz

I let the AI write the report, not decide the alerts

AI Security Scanning Tools in 2026: Snyk vs Semgrep vs OX Security — Real…