Cloudflare open-sources its no-code vibe-coding platform
▼ Summary
– Cloudflare open-sourced its internal AI app-building platform, Cloudflare OS, designed for non-developers to create applications via natural language workflows.
– The platform is used daily by thousands of Cloudflare employees for tasks like document creation, slide generation, automation, and data visualization apps.
– Cloudflare OS includes a security framework to minimize risks from “vibe-coding,” aiming to prevent serious security flaws and data breaches.
– The security model uses fine-grained app instances, where each document runs in a separate sandbox with individual permission controls and modifiable code copies.
– The sandboxing, based on Dynamic Workers, uses V8 “isolates” instead of containers, offering 100x faster startup and 10–100x better memory efficiency.
Cloudflare has officially released its internal no-code platform, Cloudflare OS, as an open-source project. Originally built as an in-house workspace, the platform lets employees, including those without engineering backgrounds, create applications through AI agents. The company pairs this launch with a security framework aimed at keeping casual “vibe-coding” sessions from introducing critical vulnerabilities or exposing sensitive data.
After months of development and internal testing, Cloudflare OS enables users to describe workflows in plain language, which an AI agent then translates into functional code. In an August 5 blog post announcing the GitHub release, the company reports that thousands of its employees rely on the platform daily to generate documents and slides, automate routine tasks, and build lightweight data visualization apps to support their workflows.
“This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild,the AI cannot introduce a significant security bug,” said Kenton Varda, principal engineer at Cloudflare, in a post on X. “We believe a company’s security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.”
The security architecture hinges on fine-grained app instances. For example, a document editor operates with each document running as its own isolated instance, Varda explained. Cloudflare OS controls access permissions for every instance, and each user gets a personal copy of the code they can modify without affecting others.
This sandboxing approach draws on a pre-existing Cloudflare feature called Dynamic Workers, but it avoids traditional software containers. Instead, it spins up “isolates,” which are instances of the V8 JavaScript execution engine. These isolates boot in just a few milliseconds and consume only a few megabytes of memory, making them roughly 100 times faster and 10 to 100 times more memory-efficient than standard container setups.
(Source: Ars Technica)
