I manage an open source project with my team in Github that has a decent amount of community contributions. One such contributor is "Dev X," who has submitted successful pull requests and been a good community member, but does not have special access via the "Manage Access" settings nor any Github "Team" membership.
The other day, I submitted a PR and requested a review from a member of my team (not Dev X) as I normally would. But before my team member got to it, I got a notification that Dev X has reviewed and approved the PR -- green check mark and everything.
My question: How did Dev X review this PR? I've dug through the settings and can't see any way to allow or prevent a developer who doesn't appear in the "Manage Access" section from reviewing PRs. Github has a lot of documentation about how to manage PRs, how to set contribution guidelines, etc., but I don't see anything about this.
To be clear, I'm not so worried about Dev X specifically. They've shown to be a good community member so far. I'm more concerned that we have a blind spot that others could slide into.