Gitfence vs git sparse checkout for monorepos
Short answer: sparse checkout chooses which files appear in your working tree. It's a performance feature run by the client, so anyone can turn it off, and the server will still send any object they ask for. It's great for speed and focus, but it isn't access control. Gitfence decides on the server what exists in someone's clone at all.
What monorepo sparse checkout does well
git sparse-checkout, usually combined with partial clone (--filter=blob:none), lets developers in large monorepos check out only the directories they work on. It's built into git, fast, and widely used.
Where it falls short for partial access
- It's configured by the client: git sparse-checkout disable restores everything.
- With partial clone, missing blobs are fetched on demand from a server that will serve them.
- History, commit messages and the full tree listing are still available.
Side by side
| Monorepo sparse checkout | Gitfence | |
|---|---|---|
| Enforced by | The client | The server |
| Can the user undo it | Yes, one command | No |
| Hidden paths in history | Present | Absent from every commit |
| Purpose | Performance and focus | Access control |
Which to choose
Choose Monorepo sparse checkout when
- Everyone may see everything and you want faster clones and a focused working tree.
- You're solving monorepo performance, not confidentiality.
Choose Gitfence when
- Some people or agents must not be able to obtain some paths.
- You can use both: sparse checkout inside a Gitfence view works like anywhere else.
Gitfence's own trade-offs
- It adds a service between restricted people and GitHub, hosted by us or self-hosted (your core team doesn't use it).
- It supports GitHub only today (github.com, and GitHub Enterprise Server when self-hosted), and Types only covers Go, Python and TypeScript.
- Hidden modules can't yet run on the restricted person's machine; Fenced CI runs the tests instead.
- It's a young product without a SOC 2 report yet (it is on our roadmap). See the security page for what's tested.
Questions
We tested: can a partial clone through Gitfence fetch hidden blobs?
No. Our security tests clone with --filter=blob:none and --filter=tree:0, and request hidden object IDs directly. The served repository doesn't contain them, and the server doesn't allow arbitrary object requests.
Sources, checked October 2026: git-sparse-checkout documentation, git partial clone.
Fence your first repository in minutes
Free for one repository and your own team. Add a restricted person and Pro is free for 14 days, no card.