[en] Duda Vibe Security Overview

[en] Duda Vibe combines Duda-managed platform security with security controls that project owners can use in their own sites and applications.

[en] Some protections are built into the Vibe platform and do not require configuration. Other controls, such as authentication, permissions, and secrets management, are available to project owners based on the needs of their project.

[en] Platform security

[en] Project and tenant isolation

[en] Vibe projects are isolated from one another at the platform level.

[en] Each project is given access only to its own resources, helping prevent one project from accessing another project's data, credentials, or runtime environment.

[en] This isolation is enforced by the Vibe platform rather than relying only on the code generated for the project.

[en] Managed security-sensitive components

[en] Where Vibe supports a Duda-managed capability, security-sensitive functions can use that capability instead of being implemented entirely in generated code.

[en] Examples include:

[en] Forms. Submissions use Duda's managed form service, including built-in spam protection and Duda's standard form-data handling.
[en] Store and cart. Supported commerce flows use Duda's managed store and cart capabilities, keeping sensitive parts of the purchase flow within the Duda platform (coming soon).
[en] Authentication. Supported sign-in flows use Duda-managed authentication rather than requiring the project to implement its own authentication system.

[en] Using managed platform components reduces the amount of security-sensitive functionality that needs to be generated specifically for each project.

[en] Open-source packages and vulnerability management

[en] Vibe does not allow projects to install arbitrary software packages.

[en] The packages available to Vibe projects are centrally managed by Duda and included in Duda's software inventory and Software Bill of Materials (SBOM).

[en] Duda monitors supported packages for known vulnerabilities as part of its vulnerability-management process and updates platform dependencies based on severity and risk.

[en] This means project owners do not need to independently select or maintain the software packages included with Vibe.

[en] Managed hosting and HTTPS

[en] Vibe projects run on Duda-managed infrastructure.

[en] Published projects (on custom domains) are served over HTTPS, and SSL certificates are managed by Duda. Project owners do not need to obtain or maintain certificates themselves. For details, see SSLs (HTTPS).

[en] Regional hosting

[en] Vibe is available within Duda's regional hosting environments.

[en] Customers using Duda's European environment can use Vibe within Duda's European hosting architecture, helping support regional data-residency requirements.

[en] Security controls for project owners

[en] Project access and publishing permissions

[en] Project owners control who can access and work on their Vibe projects through Duda account and project permissions, the same as other Duda sites. For details, see Manage Team Members and Manage Clients.

[en] For clients, editing and publishing are separate permissions, allowing organizations to control who can make changes and who can publish those changes.

[en] Authentication for site and application users

[en] For projects that require users to sign in, Vibe provides Duda-managed authentication capabilities.

[en] Supported authentication functions include user sign-in, account creation, password reset, sessions, and Google sign-in.

[en] Project owners can also define roles that can be used by their application to control access to protected functionality.

[en] Secrets and API keys

[en] Vibe provides managed storage for API keys and other secrets used by a project.

[en] Secrets are stored separately from application code and are made available to the application only when needed. Secret values are not provided to the AI model as part of the normal code-generation process.

[en] Project owners remain responsible for limiting the permissions of any third-party credentials they add to a project.

[en] Security of generated code

[en] AI-generated code can contain software defects, including security vulnerabilities.

[en] Vibe uses AI models with built-in safety mechanisms intended to reduce the generation of harmful or abusive code. Vibe also reduces risk by using managed Duda services for supported security-sensitive functions and by restricting the software packages that projects can use.

[en] However, Vibe does not currently perform a dedicated vulnerability scan of the generated source code for each project.

[en] Project owners should therefore consider the sensitivity and purpose of their application when deciding whether additional review or testing is appropriate before publication.

[en] Duda security and compliance

[en] Vibe operates as part of Duda's managed platform and security program.

[en] Duda maintains:

[en] SOC 2 Type II assurance, confirmed with an independent audit.
[en] ISO 27001:2022 with Duda’s own certification.
[en] GDPR and CCPA compliant, supported with Duda Data Processing Addendum.
[en] Penetration-tests conducted annually by third-party teams.
[en] Data encryption at rest and in transit.

[en] Additional information about Duda's broader security and compliance program is available through Duda's Trust Center.