Verdicts appear below and are announced to screen readers.
The rules
Every rule, with its regex
Tier 1 is destructive and unrecoverable: never unlockable, no flag lifts it. Tier 2 has a real external effect but is reviewable, so a human can unlock it for a short window that auto-relocks. The free repo ships tier 1; the tier-2 list and the unlock mechanism are the full kit's. Patterns are POSIX ERE matched case-insensitively against the whole command string; this page expands the POSIX classes to their JavaScript equivalents at runtime, so the strings below are byte-identical to the shell config and diff cleanly against it.
The trap this design accepts
The guard matches the whole command string, arguments included. So a commit message that quotes a gated phrase gets blocked, even though nothing destructive would run. Click both of these; only the second one blocks:
One word apart. The pattern needs git, whitespace, reset, so the first message
slips through and the second, which happens to spell the command out, does not. The guard has no idea
it's inside a quoted string, and that is the point: knowing would mean parsing shell quoting, expansion
and eval, and every parser you add is a new way to smuggle a command past the guard.
A false positive costs you one reworded commit message. A false negative costs you the repo.
The habit that fixes it: git commit -F .commit-msg instead of -m "…".