Does Gitfence support repos that already use submodules?

Fenced people can't add or change gitlinks (submodule pointers); those pushes are rejected. Commit signing through the GitHub App doesn't support submodules yet.

Gitfence vs git submodules for restricting code

Short answer: a submodule is a separate repository referenced at a fixed commit, so people without access to it simply can't fetch it. That is real access control, but it inherits every cost of splitting repos, plus submodule workflow overhead, and the people without access get an empty folder their build can't use. Gitfence keeps one repository and can give those people generated types instead of nothing.

What git submodules do well

Submodules embed one repository inside another at a specific commit. Access is whatever the submodule's own repository allows. It's built into git, needs no extra service, and is well understood.

Where it falls short for partial access

The parent pins a submodule commit, so every change inside it needs a second commit in the parent to update the pointer.
Contributors must remember --recurse-submodules and submodule update; mistakes leave stale or detached checkouts.
Someone without access gets an empty directory, so anything that imports from it stops compiling.
Granularity is the repository: you can't fence one file inside the submodule.

Side by side

	Git submodules	Gitfence
Read restriction	Per submodule repository	Per folder or file, per person
Build without access	Breaks: empty directory	Types only keeps Go, Python and TypeScript building
Workflow for your team	Pointer updates, recursive clones	Unchanged
History	Separate per submodule	One history; restricted views omit hidden paths

Which to choose

Choose git submodules when

You already maintain the private part as its own repository.
People without access never need to build the parts that depend on it.

Choose Gitfence when

You want restricted people to compile and test against the hidden code.
You need per-file or per-person access rather than per repository.
You'd rather not train everyone on submodule workflows.

Gitfence's own trade-offs

It adds a service between restricted people and GitHub, hosted by us or self-hosted (your core team doesn't use it).
It supports GitHub only today (github.com, and GitHub Enterprise Server when self-hosted), and Types only covers Go, Python and TypeScript.
Hidden modules can't yet run on the restricted person's machine; Fenced CI runs the tests instead.
It's a young product without a SOC 2 report yet (it is on our roadmap). See the security page for what's tested.