Show auditors and buyers the code they need to see
Due diligence, security audits and partner integrations need real code, not all of it. Give a read-only view of the right folders, behind an NDA, and end it when the work is done.
acme/shopon GitHubauditor's clone
Example auditor view: services/payments/ and packages/crypto/ read-only; apps/, packages/ui/ and infra/ absent.
The situation today
When an acquirer, auditor or partner needs to look at code, teams usually copy a snapshot into a data room or a throwaway repo. It goes stale immediately, and it's easy to include more than intended.
Open-core companies have a related problem every day: keeping a private monorepo while sharing some of it with a wider group.
A due-diligence view
| Path | Access | Why |
|---|---|---|
services/payments/ | Can read | In scope for the audit |
packages/crypto/ | Can read | In scope |
apps/, packages/ (rest) | No access | Out of scope |
infra/, .env* | No access | Never in scope |
How Gitfence handles it
Read-only by folder
Give the auditors group Can read on the folders in scope and No access everywhere else. They can't push at all.
Live, not a snapshot
Their view follows your GitHub repository as it changes, so findings refer to the code you actually run.
NDA and approval
Require the NDA, and approve each person after they accept the invitation.
Access end dates
Set when access ends on the invitation. After that date git, MCP and CI stop working for them.
Who could see this path?
An exposure report lists everyone who could read a path, and when, including former members. Export it for the audit file.
What it won't do
- Publishing a public, fenced view of a private monorepo for open-core projects is on the roadmap, not available today.
- Exposure reports start from the day the feature was installed; earlier history isn't known. They consider the default branch only.
Questions
Can an auditor see commit history?
Yes, for the paths they can read. Commits that only touched hidden paths don't appear in their view at all. Commits that touched both keep their message, so keep secrets out of commit messages.
Is this a replacement for a virtual data room?
For source code, it can be: the view is live, scoped and gated by signatures. Keep using your data room for documents.
Fence your first repository in minutes
Free for one repository and your own team. Add a restricted person and Pro is free for 14 days, no card.