Following its acquisition of VoidZero in June, Cloudflare has converted what was originally planned as a commercial product into an open-source deployment platform that organizations can run on their own infrastructure.
The shift reflects a broader trend: companies like Ramp and Stripe are empowering non-technical staff to develop applications using AI, even without programming backgrounds. Yet this freedom creates challenges for IT departments. Applications built outside formal oversight—sometimes called vibe-coded apps—raise questions about data access, security responsibility and governance. In essence, they represent a new form of shadow IT that bypasses traditional IT controls.
Cloudflare announced Void on Thursday as a collection of three open-source tools designed to bring structure to this landscape. The platform lets employees publish AI-generated applications while giving administrators control over who can deploy and access them.
Cloudflare's JavaScript acquisition spree
Over the past year, Cloudflare has assembled significant JavaScript expertise through multiple acquisitions. Last week it announced the purchase of Deno, the JavaScript runtime created by Node.js founder Ryan Dahl. In January, it acquired the team behind Astro, an open-source web framework. The VoidZero acquisition in June brought in the creators of Vue.js and Vite, Evan You and his team.
Each acquisition targets different areas within the JavaScript ecosystem: web frameworks, development tooling and server-side runtimes. VoidZero itself, formally unveiled in October 2024, aimed to consolidate the fragmented tools developers use when writing JavaScript. The team had already contributed to projects including Vite and Vitest, while developing Rolldown, a Rust-based bundler, and Oxc, a suite of tools for JavaScript processing and analysis.
In October 2025, VoidZero announced Vite+, an initiative to unify its development tools under a single command-line interface. Originally envisioned as a paid product, Vite+ became open source under the MIT license in March. That same month, the company introduced Void, an early-access deployment service for Vite applications intended to generate revenue from its open-source work.
The Cloudflare acquisition changed this calculus. Vite+ reached beta status over the summer and achieved a stable 1.0 release in late September. Void underwent more substantial revision, with Cloudflare's ownership eliminating the pressure to monetize the platform directly. Evan You acknowledged this shift on X following the announcement:
We started working on Void before the acquisition, originally intended to make it a commercial product. But now we no longer need to, so we've made it open source!
Evan You
The three components of Void
https://x.com/evanyou/status/2110747206584267234?ref_src=twsrc%5Etfw
Void consists of three distinct parts serving different functions. The Void SDK supplies the foundational elements for building full-stack applications with Vite, including server-side capabilities and connections to databases and external services. The Void CLI handles deployment, automatically setting up the required Cloudflare infrastructure. Void Platform offers a shared hosting environment where organizations can deploy applications and manage them through an admin interface.
The SDK and CLI were already available through npm under the MIT license, but Thursday's release makes the complete source code, including the platform itself, openly accessible alongside Void 1.0.
Running void deploy triggers the application build, provisions the infrastructure, and deploys the finished application to Cloudflare, including any required database migrations.
The self-hosted platform represents a major shift from VoidZero's original direction. Michael Dong, who moved to Cloudflare from VoidZero as a strategy lead, explains that the acquisition prompted a complete redesign:
After the Cloudflare acquisition of VoidZero, we rebuilt the platform from the ground up to work as a self-hosted platform that anyone can install and self-host on Cloudflare.
Michael Dong
Organizations can deploy their own instance using the void platform install command, which walks administrators through configuring authentication, database connections and storage.
The original Void Cloud service continues to operate as a private offering. Christoph Nakazawa, formerly a product lead at VoidZero and now director of engineering at Cloudflare, notes that access remains restricted to Cloudflare's internal team and a small group of beta testers. "It was never made publicly available," Nakazawa says. Dong reports that over 100 beta users have deployed applications through the Void SDK, though he did not clarify whether they used Void Cloud or deployed directly to Cloudflare.
Governance and oversight capabilities
Void Platform enables administrators to control deployment permissions and application access. They can examine deployments, view logs, track resource usage and set consumption limits. Integration with identity providers and Cloudflare Access lets companies restrict applications to authorized employees.
The platform also includes post-deployment troubleshooting features. Developers can review error logs via the CLI and revert deployments to earlier versions if problems arise.
Cloudflare is already running Void Platform internally, with corporate authentication serving as a safeguard against accidental data exposure. "We have a Void Platform at Cloudflare that is only accessible to employees, preventing data leaks through vibe coded apps by default," Dong explains.
These protections have limitations. Restricting access to an application does not prevent that application from accessing sensitive data or transmitting it elsewhere. Void's documentation also indicates that administrators can configure new applications to be public by default, and individual project owners can later make their applications publicly accessible.
The documented deployment workflow includes no mandatory IT security review before applications launch. When asked whether administrators can review or approve applications before they go live, Nakazawa pointed to the platform's existing access controls and the flexibility companies have to extend them:
Since Void is open source, other companies can adjust the platform to their needs.
Christoph Nakazawa
This could involve building additional approval workflows or stricter access policies, though organizations would need to implement these themselves.
Cost and infrastructure requirements
Self-hosting Void Platform requires a paid Cloudflare Workers for Platforms plan starting at $25 per month, with additional costs based on usage. The installation also depends on R2 storage and a separately maintained PostgreSQL database, introducing further expenses.
Developers using the Void SDK to deploy directly to Cloudflare do not require a paid Cloudflare plan, Dong confirms. However, organizations seeking a fully managed Void Platform hosted by Cloudflare will find no such option available at present.
For Cloudflare, open-sourcing Void creates an indirect commercial opportunity. While the software itself is free, organizations running their own Void Platform will consume Cloudflare's infrastructure and incur associated charges. Wider adoption of Void could drive increased consumption of Cloudflare's underlying services.
This infrastructure dependency raises a question about Void's long-term independence. Cloudflare has committed to keeping Vite and VoidZero's other development tools vendor-neutral, yet Void's automatic infrastructure provisioning currently depends on Cloudflare. Nakazawa attributes this to Void's design origins, noting that the platform was built around Cloudflare's infrastructure from the start.
Future changes remain possible as the open-source project evolves, though Nakazawa stopped short of guaranteeing support for competing cloud providers. "Now that it's open source, we look forward to working with the community to provide support for additional providers that offer the same baseline capabilities," he says.