"Deny non-fast-forwards" should be enabled by default. (BB-7836)
The title says it all. I don't understand why this option isn't enabled by default on all new repos. It says right there on the Branch Management page that it "can negatively impact development cycles." Allowing non-fast-forward pushes by default is dangerous.