Cloudflare's EmDash 1.0 makes sandboxed plugins ask for access first

Cloudflare released EmDash 1.0, a free open source CMS that runs each plugin in an isolated runtime with access only to its own private storage. Plugins must declare the permissions they need and get administrator approval before reaching site content, media, users, filesystem or network.

• Plugins start with private storage only and cannot touch site content without approval
• Permissions are granted individually: search reads posts, image tools get only media
• The plugin registry runs on Bluesky's AT Protocol with signed releases
• Cloudflare calls EmDash the "spiritual successor to WordPress"