We mostly use gitflow. Commits do not just "sneak in". Master is locked and needs a PR/CR to merge. The process usually takes care of the majority of the issues and usually works okay for us.