PitPro.ai: Software case study

Took a vibe-coded MVP and rebuilt it as a production-grade, multi-tenant SaaS in three weeks.

Executive summary

PitPro.ai is a Gemini-powered SaaS for professional automotive workshops. It acts as a second brain for mechanics: instant fault-code (DTC) analysis, repair-procedure generation, and manufacturer-grade maintenance data.

I was brought on to take a Lovable.dev proof-of-concept and turn it into a secure, scalable, commercially viable application. Complete architectural rewrite, security hardening, database normalization, and advanced AI features.

The vibe-coding trap (what I inherited)

Security void: Row-level security policies were non-existent. Any user could modify any data.
Exposed APIs: AI Edge Functions were unauthenticated. Anyone with the URL could drain the API quota.
Flat architecture: No relational integrity between Vehicles, Users, Service History.
Client-side trust: Critical business logic ran in the browser, easily manipulated.

Database redesign

Migrated to a fully relational, multi-tenant schema. Centralized vehicle entity (vehicles table linked by UUID), event-based history (vehicle_interventions parent + intervention_items child), and a technical_conversations table so the AI can remember prior context about a specific car.

Plate-cache table stores license plate lookups, dramatically reducing external API costs by serving cached technical data on repeat queries.

Security hardening

Wrote complex PostgreSQL RLS policies enforcing strict tenant isolation.
Custom middleware.ts with secure HTTP-only cookies for the Admin Dashboard, isolated from the user auth flow.
Upstash Redis sliding-window rate limiting on AI endpoints, protecting against DDoS and API cost abuse.
Moved all business logic to Next.js API routes, validating with Zod schemas on every input.

AI implementation

Context-aware Technical Assistant injects the active vehicle's diagnostic logs into the system prompt, so mechanics can ask about a specific Audi without re-explaining context.

Structured-output enforcement makes the LLM return strict JSON for diagnostics, so the UI renders interactive elements (checkboxes for parts, accordions for repair steps) instead of unstructured text.

A 'Scissor Logic' utility normalizes AI labor-time estimates, converting vague ranges like '1-2 hours' into precise '1h 30m to 2h' for consistent quoting.