Cloudflare has made the Void platform fully available as an open-source project, four months after acquiring VoidZero, transforming a tool originally aimed at becoming a commercial product into a platform that companies can install and self-host on Cloudflare infrastructure. This comes amid the spread of what is known as “vibe coding,” where employees create applications with the help of artificial intelligence, even without extensive programming experience.
The problem Cloudflare is targeting is not application creation itself, but what happens after applications are created: internal applications may access company data or be deployed without the IT team knowing who manages them or reviews their security. The company views these applications as a new form of shadow IT, but with a faster and less visible development cycle.
What does Void include?
Void consists of three main components. The Void SDK provides components for building full applications using Vite, including server-side functions and integration with databases and other services. The Void CLI manages the deployment process, including building the application, preparing Cloudflare resources, and applying database migrations when necessary.
Void Platform provides a shared environment for hosting and managing applications through an administrative dashboard. The platform’s code, along with the SDK and CLI, is now publicly available with the release of Void 1.0 under the MIT license. Administrators can install a private instance using the void platform install command, which guides them through configuring authentication, database connections, and storage.
What changes in practice for IT teams?
The platform allows teams to determine who can deploy applications and who can access them, inspect deployments, review logs, monitor resource consumption, and enforce usage limits. It also integrates with identity providers and Cloudflare Access to restrict applications to authorized employees. Developers can inspect error logs through the command line and roll back faulty deployments.
Michael Dong, who joined Cloudflare from VoidZero and holds a leadership role in strategy, said the company rebuilt the platform from the ground up to operate in a self-hosted format. Cloudflare uses the platform internally with corporate authentication, so applications are restricted to employees by default, according to Dong.
According to the company, more than 100 beta users have deployed applications through the Void SDK, without specifying whether the deployments took place through the Void Cloud service or directly on Cloudflare. The original Void Cloud service remains private and limited to the Cloudflare team and a small group of invited testers.
Protection limits and remaining responsibility
Access restrictions do not mean that an application is unable to read sensitive data or send it to another party. Void’s documentation also indicates that administrators can make applications public by default, and project owners can later make them publicly available. The documented deployment process does not include a mandatory security review by the IT team before an application is run.
Companies can modify open-source Void to add approval mechanisms or stricter policies, but these controls will not be integrated automatically and will require each organization to design and implement them. Therefore, Void gives IT teams a central point for visibility and control, but it does not turn applications created by employees with artificial intelligence into trusted software simply by hosting them on the platform.
The broader context
The move comes as part of Cloudflare’s expansion across the JavaScript ecosystem. The company acquired the Astro team in January and VoidZero in June, and it also announced the acquisition of Deno, the company developing the runtime environment founded by Ryan Dahl, the creator of Node.js. VoidZero had introduced in October 2024 a project bringing together JavaScript tools, including Vite, Vitest, Rolldown, and Oxc.