forks of private projects should not be able to add new users
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
If users fork a project they're able to add new users that don't have access to the main project. It would be great with an option to disable this behaviour, so the user group with access to the project, whether it be on the main project or on forks, is controlled solely by the owner of the project. I believe this is also default behaviour on Github.
I realise that any user with the source could just clone and create a new detached project and add whomever he wants, but in doing this most people would know that they'd be violating their privileges, and not do it. If users have the ability to add other users with one click, they may get the impression that this is allowed.
Other requests ask for the opposite behaviour, gitlab-ce#2351, so maybe some more fine grained control of this behaviour could be a good solution? This is probably related to the work you're doing with overall project visibility in gitlab-ce#3136.