Build software
that tastes good!
VanillaBun is a hyper-minimal web framework built on Bun. Zero dependencies. No build step. Code so simple any developer can understand it.
Modern web development is broken
Supply Chain Attacks
In 2025, CISA issued a widespread alert about npm ecosystem compromise. Zero dependencies means zero attack surface.
Dependency Hell
500MB node_modules. Thousands of unaudited packages. One breaking change cascades everywhere.
Build Complexity
Bundlers, transpilers, preprocessors. More moving parts than your actual application.
Magic & Abstraction
Hidden behavior that breaks in unexpected ways. When something goes wrong, good luck debugging it.
Constant Churn
Best practices change every year. Yesterday's patterns are today's anti-patterns. The treadmill never stops.
Bloated Bundles
Ship megabytes of JavaScript for a simple page. Your users wait while their browsers parse code they'll never use.
Software that lasts generations
Zero Dependencies
No npm packages. Your supply chain attack surface is zero. Your node_modules folder doesn't exist.
Radical Simplicity
Every file under 100 lines. No deep abstractions. When you read VanillaBun, you understand it immediately.
Stable Technologies
SQLite (stable since 2004), plain HTML, HTTP verbs, vanilla JavaScript. Foundations that last.
Conventions that keep your buns fresh
VanillaBun is not just code—it's a bakery. The Recipe ensures every project stays fresh for decades.
Explicit over Magic
No hidden behavior. If it happens, you can see why.
Isolation over Sharing
Components don't touch each other's state or DOM.
Longevity over Convenience
Code that works for years beats code that's fast to write today.
<100 lines
per file
IIFE + "use strict"
all scripts
vb-* attributes
no inline handlers
BEM classes
no generic names
"Follow The Recipe, and your buns will always rise."
Everything you need, nothing you don't
Blazing Fast
Built on Bun. Sub-millisecond cold starts. No build step required.
Enterprise Auth
Session + JWT dual auth. CSRF protection, rate limiting, refresh tokens.
Multi-Tenant
Database-per-tenant architecture. Complete data isolation. GDPR compliant by design.
SSR + SPA Hybrid
Server rendering for first load and SEO. Client navigation for instant page transitions.
Real-Time Ready
WebSocket and WebRTC signaling built in. No third-party services needed.
JSDoc Types
Full IDE autocomplete and type hints without TypeScript compilation overhead.
SQLite Native
Bun's built-in SQLite. No ORM needed. Transactions, migrations, backups included.
Security First
HttpOnly cookies, secure headers, input validation, SQL injection prevention built in.
Self-Documenting
Code so simple it documents itself. Every file under 100 lines. No hidden magic.
Ready to build something that lasts?
Join developers who've escaped dependency hell.