Pull requests - users without permissions to write to branch X can merge tasks to it

Even though i setup branch permissions (and users can't directly commit+push to the master branch) on my repository, users can still create a pull request to their task-branch, and merge it themselves

this means they can commit+push changes to the branch i'm trying to protect as an admin