Customer
The Corpus Christi Regional Transportation Authority (CCRTA) provides public transportation across the Corpus Christi, Texas region: fixed bus routes, paratransit and accessibility services, a harbor ferry, and the rider-facing information that keeps it all usable, from schedules and detours to board meetings and public notices.
Challenge
CCRTA's previous WordPress site had become a liability on three fronts. Security: like every high-visibility public-agency site, ccrta.org absorbs a constant stream of automated attacks, and a WordPress installation (a server, a database, an admin login, and a plugin ecosystem, each needing perpetual patching) gives that traffic something to hit. Accessibility: a transit authority serves riders who depend on assistive technology as a matter of daily mobility, and accessibility had been a persistent sore point on the old platform. And capability: the features riders actually wanted, starting with live bus tracking, were either impossible to build well on WordPress or available only as expensive turnkey systems.
We've written about this decision pattern in general on our blog: Why We Left WordPress Behind.
Solution
Lightning Jar rebuilt the platform on SvelteKit with TypeScript, deployed serverless on Vercel. Content management moved to Hygraph, a headless GraphQL CMS, so staff edit structured content (landing pages, topic pages, staff directories, board meetings, route maps) without touching code, and without a CMS server bolted to the public site.
The result is a site that is mostly prerendered static pages backed by serverless functions where interactivity demands it. There is no always-on server to patch, no plugin ecosystem to audit, and no admin login on the public domain.
Featured Project
The centerpiece of the new platform is a live transit map and bus tracker built directly on GTFS, the open standard for transit data, for a fraction of the cost of turnkey tracking products.
• The static GTFS feed (routes, stops, shapes, timetables) is processed by a custom enrichment pipeline into compact data the site serves instantly.
• The GTFS-Realtime feed (live vehicle positions, trip updates, and seat availability, delivered as protobuf) is decoded server-side and cached in Redis for about 25 seconds, so the upstream feed is hit only a few times a minute no matter how many riders are watching, and every rider sees near-live positions.
• Every stop has its own departure board, powered by scheduled timetables loaded into a Turso database and corrected in real time by the live feed. When the realtime feed hiccups, the boards degrade gracefully to the schedule instead of going blank.
• Lightning Jar also produced print-ready QR code stickers for every physical bus stop in the system, generated programmatically from the same data, so a rider standing at any stop can scan straight to that stop's live departures.
Accessibility
For a transit authority, web accessibility is not a compliance checkbox; many riders depend on assistive technology to plan the trips the agency exists to provide. Accessibility problems that had accumulated on the WordPress site were addressed structurally in the rebuild: semantic HTML throughout, keyboard-navigable interfaces, and accessible patterns applied consistently across schedules, maps, forms, and the tracker rather than patched page by page.
Commerce, Simplified and Hardened
The old platform's e-commerce stack was more machinery than the store needed. The rebuilt store is deliberately minimal: products are versioned content in the repository, and payment happens through the processor's hosted checkout, so card data never touches CCRTA's website at all. Riders get a simple store for passes and fare media; the agency gets a payment surface with almost nothing to attack or audit.
Security by Architecture
Public-sector websites are scanned and probed continuously by bots hunting for WordPress admin pages, vulnerable plugins, and unpatched servers. The new platform answers that traffic with architecture rather than vigilance: prerendered pages and serverless functions leave no persistent server to compromise, no database behind the public pages, and no CMS login to brute-force. Layered on top are Arcjet for edge protection, bot-poisoning on public forms, and Sentry for error monitoring, so the remaining attack surface is small, watched, and boring.
Results
• A real-time bus tracker and per-stop departure boards, built on open GTFS data at a fraction of the cost of turnkey transit tracking systems.
• Accessibility addressed structurally across the site rather than patched reactively.
• A payment flow where card data never touches agency infrastructure.
• A security posture that neutralizes the constant automated attack traffic by removing its targets: no server, no plugins, no public admin.
• Staff manage content in Hygraph without developer involvement, and riders get faster pages on every device.