Git commands that lose work ask first
Resets, forced pushes and cleans that can throw work away now ask first, while everyday git still runs without a card.
Everyday git does not ask: status, add, commit, pull, push, branch and rebase run as before. Commands that can lose work now stop for a card with a plain reason: a forced push or a deleted branch on GitHub, a reset that discards what you have not saved, a clean that deletes untracked files, and a rewrite of history.
Cleverly written versions are caught too, including the same command inside bash -c, behind a quote, or inside another command.
A saved always-allow, such as one you gave git status, still covers only that kind of command, and no saved allow covers these. A broad allow for a tool like sudo no longer lets every later sudo line through. If you allow a risky line on purpose, only that exact line is remembered.