I would have a policy that you can "freeze" a project in a branch. You are not allowed more than 3 commits per month to this branch. Unless you're pulling something from the master repo.