Yeah, which is utterly stupid, but then again, from what I remember from other systems, I'd prevent this early on by making sure people who have the permission to create a PR already earned some "merits" in the project or otherwise have proven to add meaningful contributions. Not sure whether github supports that, though.