What is the default validation for password reset?

When invoking the standard Wix password reset flow via a button on a page, i.e.:

export function forgotPassword_click(event) {
// Add your code for this event here:
console.log( “forgot password clicked” );
$w( “#errorMessage” ).collapse();
if (wixUsers.currentUser.loggedIn) {
wixUsers.logout();
}
wixUsers.promptForgotPassword()
.then( ( ) => {
console.log( “Successfully completed password reset flow.” );
wixLocation.to( “/home” );
})
. catch ( (err) => {
let errorMsg = err; // The user closed the forgot password dialog?
console.log( "Got error with forgot password prompt: " + errorMsg);
$w( “#errorMessage” ).text = "Error occurred: " + errorMsg;
$w( “#errorMessage” ).expand();
});

}

The user is prompted to enter an email address, then in the email they receive they are given a link to click, which sends them to a standard Wix page to enter a new password and confirm it via a second entry.

What are the validation rules in place for this password? I see one default is the password has to be between 4-100 characters. What else is in place? Where is this documented? Is it possible to customize the validation rules in this use case via regex?