diff --git a/README.md b/README.md
index d1cbdf4..51fd4b3 100644
--- a/README.md
+++ b/README.md
@@ -2158,13 +2158,14 @@ addresses sends, so that one client costs at most one check every
 `SWWAF_REPUTATION_CACHE_TTL`.
 
 Only a client whose history counts an offence is checked, so that the checks are
-spent on suspects: so far, one that has broken a rate limit or a byte limit,
-matched a ban rule, or had a request refused by a block rule or the Core Rule
-Set. A client dropped from the table of clients loses its history, and with it
-its offences. A client is checked in the background, at its first request after
-its offence that reaches the check: no request waits, a request refused under
-its ban is not checked, and the request that has it checked, and any other from
-it before the answer comes, goes on as from a client without a score.
+spent on suspects: so far, one that has broken a rate limit, a byte limit or the
+error burst, matched a ban rule, asked for a trap path, or had a request refused
+by a block rule, by the Core Rule Set or for a missing or wrong token. A client
+dropped from the table of clients loses its history, and with it its offences. A
+client is checked in the background, at its first request after its offence that
+reaches the check: no request waits, a request refused under its ban is not
+checked, and the request that has it checked, and any other from it before the
+answer comes, goes on as from a client without a score.
 
 A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE`, 75 by default, is a hit, and
 `SWWAF_REPUTATION_ACTION` says what is done with its client, as for a DNSBL
diff --git a/SPEC.md b/SPEC.md
index 428df09..c2bf8ed 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -225,9 +225,9 @@ address or one /64, so a permanent ban does not reach neighbours who did
 nothing.
 
 An offence is a request `smallwebwaf` holds against the client: one that carries
-a clear sign of attack, breaks a limit, or is refused by a rule file or the Core
-Rule Set. Offences are counted by kind in the client's history. Two kinds lead
-to a ban, each by its own rule:
+a clear sign of attack, breaks a limit, or is refused by a rule file, by the
+Core Rule Set or for a missing or wrong token. Offences are counted by kind in
+the client's history. Two kinds lead to a ban, each by its own rule:
 
 - A clear sign of attack: a request that matches a rule file rule whose action
   is `ban`, or asks for a path in `SWWAF_TRAP_PATHS`. Examples are a probe for a