Gitfence
Start free

Adding a contractor or new hire

Invite a contractor or new hire, choose their access, require an NDA and set an end date. What they clone and how they start.

Short answer: An invitation is a link that gives one person, one email domain or anyone who has it a copy of the repository with only the access you choose. They sign in with GitHub, sign any documents you require, and clone with plain git.

Steps

  1. Open the invitation dialog. In the repository, open People and choose Invite people.
  2. Choose who can use the link. Under Who can use the link, pick A GitHub user, Email addresses, An email domain or Anyone with the link. A GitHub user and a list of addresses each get a link that works once; an email domain and an open link can be used by several people.
  3. Choose what they get. Under Where they get access, pick the repository and the Access group. Add an Add an exception for this person only when one path should differ from their group. Use Add another repository to cover several at once.
  4. Require documents if you need them. Under Before they get access, tick any document from Documents. Tick I approve each person after they accept if you want to let each person in by hand. Until every required document is signed, git, MCP and Fenced CI refuse and tell them what to sign.
  5. Set the limits. Under Limits, choose how long the link works (1, 7 or 30 days), how many people may use it, and optionally an Access ends on date. Access ends automatically on that date.
  6. Send it. Choose Create invitation link or Create and email invitation. Copy the link or the ready-made message now: it is shown once.

What the person sees

They open the link, choose Sign in with GitHub to continue, read and sign the documents, and choose Join. Their Gitfence home shows the clone command:

git clone https://gitfence.dev/<owner>/<repo>.git

When git asks for a password, the username is their GitHub login and the password is a Gitfence token. They choose Create token on their Gitfence home; it works for 90 days. They can also create an agent token for Claude Code, Codex or Cursor.

Gotchas

  • Their clone contains only the paths their group and exceptions allow. Hidden paths are absent from history, not merely ignored.
  • Pushes go to their own branches and become pull requests. They cannot push to the protected default branch.
  • A signature records the document version and hash, the typed name, time, IP address and browser.
  • Setting an end date or a trial ladder is not the same as revoking access already cloned: code they already have stays on their machine.

Next: the access ladder and offboarding.

Related guides