I totally misunderstood the access control mechanism (but it's logical that it behaves the way it does), and so on git projects with "open" source access, repos were write-for-all. This should fix it by enforcing member-or-owner auth for writes. Signed-off-by: Patrick Georgi <patrick@georgi-clan.de>