Hooks are executable files named after the event (pre-commit, commit-msg, pre-push). If one exits non-zero, Git aborts the operation. They live in .git/hooks by default, which is not versioned, or in the directory set by core.hooksPath. --no-verify skips them, so they are a guard rail, not security.