Upon direct pushes, the protected branch checks on Mercurial projects are actually bypassed. This doesn't really happen with the default settings because - protected branches are almost always Mercurial named branches, i.e., `branch/something`. - mere Developers can't publish changesets, hence a direct push without topic is blocked, since it translates directly into publication. But projects that disable auto publishing of changesets without topics are affected. This has been going for a long time, and has to qualify as a security gap, although not a very bad one.