Employees are vibe-coding their own apps. Cloudflare open-sources Void to give IT a handle on them
The New Stack Paul Sawers
Employees are building their own AI apps at work, and IT can’t always see them. Cloudflare’s open-source Void is meant to bring those apps back under admin control.
Based on reporting by The New Stack, Paul Sawers — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Companies are handing employees AI tools and, in some cases, letting non-engineers build apps for coworkers. That sounds empowering until IT has to ask the awkward questions: who can see the data, who can deploy, and who is on the hook when something breaks? Cloudflare’s answer is Void, an open-source set of tools announced Thursday that gives enterprises a self-hosted place to manage those employee-made apps.
Void now ships as three parts. The SDK helps build full-stack Vite apps with server-side features and outside integrations. The CLI handles deployment and can provision the Cloudflare pieces needed to run it. And the platform itself is the part IT will care about: a shared environment with an admin dashboard, access controls, deployment logs, usage limits and the ability to inspect resource use.
The release is also a big shift from how Void began. VoidZero had originally worked on it as a commercial product before the Cloudflare acquisition changed the calculus. Michael Dong, now a strategy lead at Cloudflare, says the platform was rebuilt “from the ground up” so companies can install it themselves on Cloudflare. Christoph Nakazawa says the original Void Cloud stayed private and was never opened up to the public.
Cloudflare says it is already using Void internally, and Dong says employee-only access helps prevent leaks from vibe-coded apps by default. But that protection only goes so far. The documentation still allows apps to be public, there is no mandatory security review before deployment, and restricting access does not stop an app from pulling sensitive data and sending it somewhere else. Companies can add stricter rules themselves, if they are willing to build them.
There is a catch in the fine print: self-hosting Void Platform requires a paid Cloudflare Workers for Platforms plan starting at $25 a month, plus R2 storage and a PostgreSQL database. Cloudflare is also leaving the door open for future support of other providers, but for now Void’s automatic provisioning is tied to Cloudflare. So yes, the company has made the software open source. It has also made sure the plumbing still runs through its own house.
My take — AI-written commentary, not fact-checked reporting
This is the right move, and not just because shadow IT with a nicer haircut is still shadow IT. The real trick is that Cloudflare gets to look generous while keeping the infrastructure bill and the lock-in story very much alive. Open source is doing a lot of heavy lifting here, as usual.
Read more about this at: The New Stack
