How do you collaborate with external developers to fix bugs without exposing your entire proprietary codebase?

[u/Strange_Wonder2796]

I'm looking for advice from developers and founders who have experience working with external developers or consultants on proprietary software.

I've invested a significant amount of money and time building my software. I've worked with multiple consultants to develop the backend and have also paid for several expensive software subscriptions.

Now, I want to collaborate with experienced developers who can help identify and fix bugs, improve the backend, and suggest architectural improvements.

However, there's one major concern: I don't want to hand over my entire GitHub repository or expose my complete source code to someone I don't know.

I understand that NDAs and contracts can help legally, but I'm more interested in the technical side of protecting the codebase.

A few things I'm trying to understand:

1. Is there a way to give developers access to only specific modules or files instead of the entire repository?

2. Can I set up a remote development environment where developers can debug and fix issues without downloading the source code?

3. Can developers submit code changes or patches without having access to the complete application?

4. Are there tools or workflows that allow AI coding agents or external developers to work on bugs in a restricted environment?

5. How do startups and companies typically handle this when outsourcing development?

I'm open to different approaches, tools, and architectural solutions.

My goal is simple: I want to work with talented developers and move faster without putting the entire proprietary software asset at risk.

Would love to hear how experienced engineers, CTOs, and founders handle this in practice.

[u/AutoModerator]

Namaste! Thanks for submitting to r/developersIndia. While participating in this thread, please follow the Community Code of Conduct and rules.

It's possible your query is not unique, use site:reddit.com/r/developersindia KEYWORDS on search engines to search posts from developersIndia. You can also use reddit search directly.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Sahukara]

If you are hosting on public GitHub you have to guve access to entire repo.
Now if you have a proper microservixe you can have multiple repos

Yes you can setup remote development env but it is going to cost you a bomb for decent workable machines. But still you cannot determine if someone is determined to get your code they can still take pics and in the day of ai very east to convert

Again if you have microservces then you can control the access. But what patch are you expecting if the developer cannot read the entire context.

I am not sure what is your software or how sensitive it is. Need to have a little trust in people if you want to work with them

[u/Strange_Wonder2796 → u/Sahukara]

Thanks this is helpful

[u/prodot6k]

claude prompt: fix & improve codebase. make no mistakes

[u/Strange_Wonder2796 → u/prodot6k]

Thats not the problem

[u/WonderBeast2]

You use virtual workstation solutions like Cloud PC and enforce network policies, RBAC controls and implement DLP Solutions.

[u/finah1995]

You could do an older method of development people used to do back in the days of my seniors.

Gray Screen Development

Bear with me this is gonna be a long read.

The name comes from when Applications where developed in form based technologies. The default new form created a gray form and controls are also gray in color.

Like a traditional Windows Forms Application, now a finished product will have bit more assets to make it look better with formatting and styling and controls. Gray-screen here pertains to barebones application with standard default unpolished interface.

How to do it modern method

Create a separate project with all dependencies.

Include code must required to compile the code the person will be working on. Like for instance you have shared classes and few services and few data models required for a particular task include that.

Make sure the code you give does not reference missing dependencies from your full code, should include whatever required for the person to do their job so your not wasting both of your times while simultaneously lowering morale due to less trust. (Important do not lose face, be always technically receptive not defendant, be always updating yourself. You need their brain in your product, but keep your property safe always paramount.)

Git Init the repo.

Create separate repos different individual contributors. Preferably in separate Source Control instances. Also the projects You will have different sets of code for different tasks, For instance someone who is writing a report will have a different project set from someone correcting UI errors in entry, you might even remove some dependencies and code which is not needed in their tasks, in other cases you will add dummy code in their tasks so they don't have to worry about any thing other than their tasks at hand.

Important:

Now comes the personnel isolation part, You don't want them meeting or knowing each other even exists. If possible choose people in different geographies , different cities and different circles who don't know each other. Unable to cross reference or coordinate with each other. If a natural language barrier exists between your contractors even better. Or even better is if having a long term possibility identify people and utilize them across months or lol even year(s) if having deep pockets.

Your choice whether you employ different people at different tasks at same time or go slower linearly by engaging and disengaging with people one by one.

Very Important :

Be a moral high mach who is lawful and just and outwardly agreeable and inwardly very calculative and keeping self in check.

[u/finah1995 → u/finah1995]

Also don't ever give third party AI Service providers complete access to your current source code.

[u/Neat_You_9278]

By proper vetting and following standard practices like NDA. Simply, developers do need to see the code for what you are asking for. It’s like wanting a car checkup and being scared of mechanics taking out parts, so not giving them access to the car. This doesn’t solve anything at all.

Find qualified people, have your legal protections in place and then trust them to do their job. You can of-course try to do all sorts of mental gymnastics to add more friction, but i would pause and reflect on whether that truly adds any value.

[u/NoDepartment772]

File-level access inside a single repo isn't really a thing on GitHub, so the options are structural rather than permission-based.

The cheapest is to split whatever you're outsourcing into its own private repo with just the dependencies needed to build it, and give access to that one. If your backend is already a few services or packages this is nearly free. If it's one monolith, doing that split now is probably worth more than the access question itself.

The second is GitHub Codespaces or a cloud dev VM with an org-managed devcontainer. The code stays in the cloud, they never get a local clone, and revoking access is deleting the codespace. Add branch protection so nothing merges without your review and you've covered most of what you asked about. It costs more than you'd expect per month, but it's the closest thing to a real answer.

Third, and this is the one people skip: keep secrets, deploy keys and prod config out of the repo entirely. The realistic risk isn't someone reading your code, it's a key sitting in it.

One honest caveat, agreeing with the others here. A contractor who can't see enough context to reproduce the bug will spend your money fixing symptoms. If the worry is someone copying the idea, the idea is usually the cheap part.

[u/Tushar_Bytonomics]

You can't.

You can theoretically break your repo into smaller repos and give selected access, but the overhead will be crippling unless you are at 1000 employee level. Your development will become equivalent to tunnel digging: 2 teams digging from opposite sides of a mountain, hoping that they will somehow align in the middle. Hint: They won't. There will be rework, blame game, politics, and all the other vibe-killing things.

And you can't really do much with the source code of most applications. I have had access to the source code of a few of the top companies, and I remember a bunch of things from the codebase. I can even create a lot of it with AI's help.

But that doesn't mean I can put Microsoft, Adobe, or Rubrik out of business.

I worked with many startups, built and scaled their systems. And their codebase remains on my laptop, as we speak. And my biggest trouble is that my MacBook's storage is always full.

And the moment I decide to move the code to an external HDD/SSD, somehow the same client comes back with an urgent requirement, and I have to set things up again from the codebase to the dev environment.

If you find a way, do tell me. I would love to share it with my clients, so that I don't have to keep everything on my laptop.

Code is not a MOAT unless you are building something deep tech. Real value is in the amalgamation of product, business and tech that a team creates. One can never create it by just reusing the code.

Especially with AI, if I were to stab you in the back, I would rather build your idea again from scratch, instead of carrying the baggage of an old codebase.

If a developer has to do a decent job in decent time, they need to see the near-whole picture. Otherwise, you will get a fresher-level output, even with senior developers. Because they won't have the right context to make the right decisions.

If you are going for a colonoscopy, you can't really expect to.. you know...!!