In short, every commit can be in one of three phases, secret, draft, and public. Commits transition to public when you push them somewhere someone else might depend on them, and rebase won’t allow you to rebase any public commits.

Commits can of course be manually transitioned back as a “I know what I’m doing step” but this provides a lot of safety for casual rebases.

(Secret just prevents the commit from being accidentally pushed)