diff --git a/crates/redact/README.md b/crates/redact/README.md
index 9c2793e248..2caf067b5b 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -71,7 +71,11 @@ sanitize::sanitize(&mut doc)?;                             // all of them
 Categories: metadata (`/Info`, XMP), file attachments, comments, form fields (flattened so the
 values stay visible), hidden text (render modes 3 and 7, or wholly off the page), hidden layers
 (content of off optional-content groups, then the groups), bookmarks, links/actions/JavaScript,
-and `/PieceInfo` private data. Both make the next save a full rewrite.
+and `/PieceInfo` private data. XMP metadata, private data, associated files (`/AF`) and
+additional actions (`/AA`) are removed from every object reachable from the catalog that owns
+them (images, fonts, Forms, annotations and fields as well as the catalog and pages), never from
+name maps such as resource dictionaries. Content is read strictly: a page whose content can't be
+read in full is refused, not cleaned in part. Both make the next save a full rewrite.
 
 `patterns` finds phone numbers, e-mail addresses, credit card numbers (Luhn-checked), US Social
 Security numbers and dates for Search & Redact.