diff --git a/docs/api.md b/docs/api.md
index b412aba..8d95c6f 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -54,7 +54,8 @@ Content-Security-Policy. As a side effect, sanitized output is always
 well-formed HTML.
 
 `html_full` is the deliberate exception: it is stored and served **exactly**
-as posted, with no sanitization and no restrictive CSP. It is the
+as posted — no sanitization, no restrictive CSP, and no HTML/CSS validation
+(malformed markup is kept as-is rather than rejected or repaired). It is the
 "poster owns all presentation, including any scripts and the security
 implications" escape hatch — only post trusted content as `html_full`.