1 files changed, 5 insertions, 4 deletions

diff --git a/spec.txt b/spec.txt
index c619e9c..6c660bb 100644
--- a/spec.txt
+++ b/spec.txt
@@ -4285,13 +4285,14 @@ corresponding codepoints.
 [Decimal entities](@decimal-entities)
 consist of `&#` + a string of 1--8 arabic digits + `;`. Again, these
 entities need to be recognised and transformed into their corresponding
-unicode codepoints. Invalid unicode codepoints will be written as the
-"unknown codepoint" character (`0xFFFD`)
+unicode codepoints. Invalid unicode codepoints will be replaced by
+the "unknown codepoint" character (`U+FFFD`).  For security reasons,
+the codepoint `U+0000` will also be replaced by `U+FFFD`.
 
 .
-# Ӓ Ϡ �
+# Ӓ Ϡ � �
 .
-<p># Ӓ Ϡ �</p>
+<p># Ӓ Ϡ � �</p>
 .
 
 [Hexadecimal entities](@hexadecimal-entities)