I invited a new dev to my gitlab project with “developer” permissions, and told him to create a new branch and PR for me to approve. And then came back after the weekend to find he’d pushed a ton of commits direct to master (which is protected).
What did I get wrong setting this up? Is there a step I missed?