← Home ← Codex ← DEBT
Browse by Category
+ added · updated 7d
← Back to glossary

Commit Message Best Practices

Style Beginner
debt(d3/e1/b3/t5)
d3 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'default linter catches the common case' (d3). The term's detection_hints specify commitlint, husky, and git-hooks as tools that can enforce commit message standards. These are commonly integrated into CI/CD pipelines and pre-commit hooks, catching violations before code is merged. Not quite d1 since it requires explicit setup, but readily available tooling exists.

e1 Effort Remediation debt — work required to fix once spotted

Closest to 'one-line patch or single-call swap' (e1). The quick_fix is straightforward: rewrite the commit message following the 'what and why' pattern. Git allows amending recent commits (git commit --amend) or interactive rebase for older ones. Each fix is a single message rewrite with no code changes required.

b3 Burden Structural debt — long-term weight of choosing wrong

Closest to 'localised tax' (b3). Poor commit messages create a localized documentation debt — they don't poison code execution or architecture, but they do impose a persistent minor tax when developers need to understand change history. The impact is contained to git archaeology rather than affecting runtime behavior or system structure.

t5 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'notable trap' (t5). The misconception field explicitly states developers think commit messages are for themselves rather than future maintainers. This is a documented gotcha that most developers eventually learn through painful experience debugging code 18 months later. The 'obvious' approach (describing what you did in past tense) contradicts the imperative style that git itself uses.

About DEBT scoring →

Also Known As

git commit message conventional commits commit style

TL;DR

Clear commit messages that explain why a change was made, not just what — enabling efficient git log navigation, automated changelog generation, and informed code archaeology.

Explanation

The seven rules of a good commit: (1) Separate subject from body with a blank line, (2) Limit subject to 50 chars, (3) Capitalise subject, (4) No period at end, (5) Use imperative mood ('Add' not 'Added'), (6) Wrap body at 72 chars, (7) Use the body to explain what and why, not how. Conventional Commits format (feat:, fix:, chore:) enables automated semantic versioning and changelog generation. git log --oneline should tell a story of the project's evolution.

Common Misconception

Commit messages are for the commit author — commit messages are primarily for future developers (and your future self) trying to understand why a change was made 18 months ago.

Why It Matters

Good commit messages turn git log into documentation — a well-written commit explaining why a security check was added prevents future developers from 'cleaning up' the code and reintroducing a vulnerability.

Common Mistakes

  • 'WIP', 'fix', 'update', 'misc' — meaningless; what work, what fix, what update?
  • Subject line > 72 characters — truncated in most git tools.
  • No body explaining the why — the diff shows what changed; the message should explain why.
  • Past tense ('Added feature') instead of imperative ('Add feature') — inconsistent with git's own messages.

Code Examples

✗ Vulnerable
# Useless commit history:
git log --oneline
abc123 fix
def456 update
ghi789 WIP
jkl012 changes
# 6 months later: which commit introduced the security regression?
# No way to know without reading every diff
✓ Fixed
# Conventional Commits — searchable, automatable:
git log --oneline
abc123 fix(auth): prevent session fixation after password reset
def456 feat(checkout): add Apple Pay support
ghi789 refactor(user): extract email validation to ValueObject
jkl012 security: rotate JWT signing key after exposure in logs

# Full commit with body:
fix(auth): prevent session fixation after password reset

Session was not regenerated after successful password reset,
allowing an attacker with a pre-existing session ID to take
over the account. Fixes CVE-2026-1234.

Closes #456

Added 16 Mar 2026
Edited 22 Mar 2026
Views 55
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings T 0 pings W 1 ping T 2 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 2 pings T 1 ping F 3 pings S 1 ping S 2 pings M 0 pings T 0 pings W 1 ping T 0 pings F 0 pings S 1 ping S 0 pings M 0 pings T 1 ping W 0 pings T 0 pings F 0 pings S 0 pings S 1 ping M 0 pings T 0 pings W
No pings yet today
No pings yesterday
Amazonbot 7 Scrapy 7 Perplexity 6 Google 5 Ahrefs 4 Unknown AI 3 Claude 2 SEMrush 2 Meta AI 1 Sogou 1 Bing 1 Yandex 1 PetalBot 1
crawler 37 crawler_json 3 pre-tracking 1
DEV INTEL Tools & Severity
🟢 Low ⚙ Fix effort: Low
⚡ Quick Fix
Write commit messages as 'what and why', not 'what and how' — the diff shows what changed, the message should explain why it changed and what problem it solves
📦 Applies To
any web cli
🔗 Prerequisites
🔍 Detection Hints
Commit messages: 'fix stuff', 'WIP', 'asdf', 'minor changes'; no type prefix; body missing for complex changes
Auto-detectable: ✓ Yes commitlint husky git-hooks
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: Low Context: File


✓ schema.org compliant