Cloudflare Open-Sources Void to Manage Employee-Built AI Apps

Following its acquisition of VoidZero in June, Cloudflare has transformed what was originally planned as a commercial offering into an open-source deployment platform that organizations can host themselves. The move comes as enterprises increasingly encourage staff to develop their own software using AI tools, regardless of technical background. Companies like Ramp and Stripe have already built internal systems enabling non-engineers to create applications for colleagues, but this trend has created new challenges for IT teams managing security, data access and accountability.

These employee-built applications represent a modern form of shadow IT, with software being deployed outside traditional IT oversight. Cloudflare announced Void on Thursday as a response to this challenge—a collection of three open-source tools that provides a self-hosted platform where companies can deploy, manage and govern applications created by their workforce. The system allows administrators to control who can publish applications and who can access them.

Cloudflare's growing JavaScript empire

Over the past year, Cloudflare has assembled significant expertise in the JavaScript ecosystem through multiple acquisitions. Last week, the company announced it had acquired Deno, the JavaScript runtime created by Node.js founder Ryan Dahl. In January, Cloudflare acquired the team behind Astro, an open-source web framework. The VoidZero acquisition in June brought on board the creator of Vue.js and Vite, Evan You, along with his team focused on JavaScript development tooling.

VoidZero, formally unveiled in October 2024, was founded with the goal of consolidating the various tools developers use when working with JavaScript. The team had already contributed to major open-source projects including Vite and Vitest, while also developing Rolldown, a Rust-based bundler, and Oxc, a toolkit for JavaScript code processing and analysis.

In October 2025, VoidZero announced Vite+, designed to unify its development tools under a single command-line interface. Originally envisioned as a paid product, Vite+ was released as open source under the MIT license in March. That same month, the company introduced Void, initially as an early-access deployment service for Vite applications intended to generate revenue from its open-source work.

We started working on Void before the acquisition, originally intended to make it a commercial product. But now we no longer need to, so we've made it open source!

Evan You

Since Cloudflare's acquisition, Vite+ has continued evolving, reaching beta status over the summer and achieving a stable 1.0 release in late September. The most significant shift has occurred with Void, as Cloudflare's ownership eliminated the pressure to monetize the platform directly. You acknowledged this change on X following Thursday's announcement, noting that the acquisition removed the need to pursue commercial revenue from Void.

Into the void: Full-stack apps via Vite

https://x.com/evanyou/status/2110747206584267234?ref_src=twsrc%5Etfw

Void consists of three distinct components serving different functions. The Void SDK supplies the necessary building blocks for constructing full-stack applications with Vite, including server-side capabilities and connections to databases and other services. The Void CLI manages deployment by automatically setting up the required Cloudflare infrastructure. The Void Platform offers a shared hosting environment where organizations can deploy applications and manage them through an administrative interface.

While the SDK and CLI were previously available through npm under the MIT license, Thursday's announcement made the complete source code publicly accessible, including the platform itself, alongside the Void 1.0 release. Running void deploy triggers the application build, provisions infrastructure, and publishes the finished application to Cloudflare, including any necessary database migrations.

The self-hosted platform represents a substantial shift from VoidZero's original direction. Michael Dong, who transitioned from VoidZero to Cloudflare as a strategy lead, explains that the acquisition prompted a complete redesign of the underlying technology.

After the Cloudflare acquisition of VoidZero, we rebuilt the platform from the ground up to work as a self-hosted platform that anyone can install and self-host on Cloudflare.

Michael Dong

Organizations can deploy their own instance using the void platform install command, which walks administrators through configuring authentication, database connections and storage. The original Void Cloud service continues operating as a private offering. Christoph Nakazawa, formerly a product lead at VoidZero and now director of engineering at Cloudflare, notes that access has remained restricted to Cloudflare's internal team and a limited group of beta testers.

Dong reports that more than 100 beta users have deployed applications using the Void SDK, though he did not clarify whether these deployments used Void Cloud or went directly to Cloudflare.

Keeping employees' apps in check

Void Platform enables administrators to set policies around who can deploy applications and who can access them. Administrators can examine deployments, access logs, track resource usage and establish consumption limits. Integration with identity providers and Cloudflare Access allows organizations to restrict applications to authorized personnel only.

The platform also includes debugging capabilities for deployed applications. Developers can review error logs through the CLI and revert problematic deployments to previous versions.

Dong notes that Cloudflare is already operating Void Platform internally, with corporate authentication serving as a safeguard against employees unintentionally leaking company data.

We have a Void Platform at Cloudflare that is only accessible to employees, preventing data leaks through vibe coded apps by default.

Michael Dong

These protections have limitations, however. Restricting who can access an application does not necessarily prevent that application from extracting sensitive information or transmitting it elsewhere. Void's documentation also indicates that administrators can configure new applications to be publicly accessible by default, and individual project owners retain the ability to make their applications public.

The documented deployment workflow includes no mandatory security review by IT before applications launch. When asked whether administrators can review or approve applications before they go live, Nakazawa points to the platform's existing access controls and the flexibility for companies to enhance them.

Since Void is open source, other companies can adjust the platform to their needs.

Christoph Nakazawa

This could involve implementing additional approval workflows or more stringent access policies, though organizations would need to develop and maintain these additions themselves.

Cost considerations also factor into the equation. Organizations self-hosting Void Platform must subscribe to a paid Cloudflare Workers for Platforms plan starting at $25 monthly, with additional charges based on consumption. The deployment also requires R2 storage and a separately maintained PostgreSQL database, creating additional expenses.

Dong clarifies that developers deploying applications directly to Cloudflare using the Void SDK do not require a paid Cloudflare subscription. However, companies seeking Cloudflare to operate their Void Platform as a managed service have no option currently available.

For Cloudflare, releasing Void as open source creates a potential business advantage. Although the software itself is free, organizations running their own Void Platform will consume Cloudflare's infrastructure and incur associated costs. Cloudflare essentially benefits from broader adoption of the software through the underlying services required to run it.

These infrastructure dependencies raise a broader question: how dependent will Void remain on Cloudflare's platform? Cloudflare has committed to keeping Vite and VoidZero's other development tools vendor-agnostic, but Void's automatic infrastructure provisioning currently relies exclusively on Cloudflare. Nakazawa attributes this to Void's design history, explaining that the platform was built specifically around Cloudflare's infrastructure from inception.

This may evolve as the open-source project matures, though Nakazawa declined to guarantee support for competing cloud platforms.

Now that it's open source, we look forward to working with the community to provide support for additional providers that offer the same baseline capabilities.

Christoph Nakazawa