one can go as far as preventing pushes altogether, or don't give them write permissions to your repos