Comment 1 for bug 2012558

other avenues that would lessen the blow on this:
- a setting on the project to disallow sharing completely (automatic or otherwise, or disallow automatic only). this means either an individual user pushing an MP cannot add a reviewer who doesn't already have access to the repo as a whole, or they can but the reviewer will not be able to click through to the MP at all (which might be raised as a bug but it's a _safer_ bug)
- a notification to project owners + maintainers whenever a new person has access to the code who did not have access before