Duda Vibe combines Duda-managed platform security with security controls that project owners can use in their own sites and applications.
Some protections are built into the Vibe platform and do not require configuration. Other controls, such as authentication, permissions, and secrets management, are available to project owners based on the needs of their project.
Vibe projects are isolated from one another at the platform level.
Each project is given access only to its own resources, helping prevent one project from accessing another project's data, credentials, or runtime environment.
This isolation is enforced by the Vibe platform rather than relying only on the code generated for the project.
Where Vibe supports a Duda-managed capability, security-sensitive functions can use that capability instead of being implemented entirely in generated code.
Examples include:
-
Forms. Submissions use Duda's managed form service, including built-in spam protection and Duda's standard form-data handling.
-
Authentication. Supported sign-in flows use Duda-managed authentication rather than requiring the project to implement its own authentication system.
Using managed platform components reduces the amount of security-sensitive functionality that needs to be generated specifically for each project.
Vibe does not allow projects to install arbitrary software packages.
The packages available to Vibe projects are centrally managed by Duda and included in Duda's software inventory and Software Bill of Materials (SBOM).
Duda monitors supported packages for known vulnerabilities as part of its vulnerability-management process and updates platform dependencies based on severity and risk.
This means project owners do not need to independently select or maintain the software packages included with Vibe.
Vibe projects run on Duda-managed infrastructure.
Published projects (on custom domains) are served over HTTPS, and SSL certificates are managed by Duda. Project owners do not need to obtain or maintain certificates themselves. For details, see SSLs (HTTPS).
Project owners control who can access and work on their Vibe projects through Duda account and project permissions, the same as other Duda sites. For details, see Manage Team Members and Manage Clients.
For clients, editing (coming soon) and publishing are separate permissions, allowing organizations to control who can make changes and who can publish those changes.
For projects that require users to sign in, Vibe provides Duda-managed authentication capabilities.
Supported authentication functions include user sign-in, account creation, password reset, sessions, and Google sign-in.
Project owners can also define roles that can be used by their application to control access to protected functionality.
Vibe provides managed storage for API keys and other secrets used by a project.
Secrets are stored separately from application code and are made available to the application only when needed. Secret values are not provided to the AI model as part of the normal code-generation process.
Project owners remain responsible for limiting the permissions of any third-party credentials they add to a project.
AI-generated code can contain software defects, including security vulnerabilities.
Vibe uses AI models with built-in safety mechanisms intended to reduce the generation of harmful or abusive code. Vibe also reduces risk by using managed Duda services for supported security-sensitive functions and by restricting the software packages that projects can use.
However, Vibe does not currently perform a dedicated vulnerability scan of the generated source code for each project.
Project owners should therefore consider the sensitivity and purpose of their application when deciding whether additional review or testing is appropriate before publication.
Vibe operates as part of Duda's managed platform and security program.
Duda maintains:
-
SOC 2 Type II assurance, confirmed with an independent audit.
-
ISO 27001:2022 with Duda’s own certification.
-
GDPR and CCPA compliant, supported with Duda Data Processing Addendum.
-
Penetration-tests conducted annually by third-party teams.
-
Data encryption at rest and in transit.
Additional information about Duda's broader security and compliance program is available through Duda's Trust Center.