When a company brings an outside developer or an AI agent into its codebase, it already has options. We think the honest way to explain Occlude is to go through them first, including the one we lose to most.
NDA and full access
What almost everyone does, and the option we lose to most. It is free, it is instant, and procurement already has the template. It is also contractual, not technical: you learn what someone saw after they have seen it, and only if they tell you.
For many teams that is an acceptable risk. For a payments company with half its repository in compliance scope, the assessor's question, who could read the cardholder code?, has only one answer: everyone.
VDI and cloud development environments
Codespaces, Coder, Citrix Secure Developer Spaces, Amazon WorkSpaces. The code stays in your cloud and nothing lands on the contractor's laptop. That is real, and worth paying for.
Inside the workspace, though, access is the repository. GitHub's documentation for Codespaces puts it plainly for anyone with write access: "The token will be scoped for read/write access to the repository." Everyone who can open the workspace can read every file in it. The code stays home, and that is the whole control.
Split the repository
GitHub, GitLab and Microsoft all recommend it, and it costs nothing in licences. Put the sensitive code in its own repository, give contractors the rest, and publish an interface between the two.
It works until the codebase is a monorepo with shared types, which describes most of the codebases where this matters. Then the contractor builds against a mock, the mock drifts from the real thing, and every change pays an integration tax, forever.
Perforce protections
Deny the read right on a path and the file never syncs. Perforce's own manual says what follows: with that right denied, "users cannot use p4 print, p4 diff, or p4 sync on files", so a build that needs them breaks. Deny less and the build works, with the source on their disk. The longer version is here.
Ship binaries
The automotive answer: deliver the protected module as compiled object code behind a fixed interface. The build keeps working, and export-control rules treat object code more leniently than source.
It works for a stable library. It fails when someone edits next to that code every day, because the binary is stale the moment the protected code changes.
What none of them do
Every option makes the same trade: keep the code out of sight, or keep the build green. An NDA and a cloud development environment keep the build and give up the secrecy. Perforce and a split repository keep the secrecy and give up the build. Binaries keep both only while nothing changes.
Occlude is built on the bet that the trade is not necessary: a workspace where the person sees the task's files and the compiler sees all of them. Think of it as binary delivery with a live build.
And if your repositories already match who may see what, or your codebase is small enough to split cheaply, you do not need us. Splitting the repository does the job.
Sources
- Security in GitHub Codespaces, for the token scope.
- p4 protect, the Helix Core command reference.
- Our page: How it works.
Want to go through this for your codebase?
Or write to contact@occludehq.com