Most of these are dumb rules, but a few really makes you feel like something smelly is going on in the underlying code. Like the first one that specifically restrict %, my head started screaming “sql injection somewhere”