The three repo settings v1.16.0 added (krz/gitbay#189, #197, #201). A default-branch menu over the branches repo refs lists, since the server refuses a name it does not have; a merge-requests-only toggle beside the protected branches; and a protected-tags glob list beside them, each row with its own unprotect identifier so the live suite cannot hit the branch's. Live repo flow round-trips the toggle and a glob.