--- a/doc/hgrc.5.txt
+++ b/doc/hgrc.5.txt
@@ -50,6 +50,8 @@ installed.
     particular repository.  This file is not version-controlled, and
     will not get transferred during a "clone" operation.  Options in
     this file override options in all other configuration files.
+    On Unix, this file is only read if it belongs to a trusted user
+    or to a trusted group.
 
 SYNTAX
 ------
@@ -364,6 +366,17 @@ server::
     6Mbps), uncompressed streaming is slower, because of the extra
     data transfer overhead.  Default is False.
 
+trusted::
+  Mercurial will only read the .hg/hgrc file from a repository if
+  it belongs to a trusted user or to a trusted group.  This section
+  specifies what users and groups are trusted.  The current user is
+  always trusted.  To trust everybody, list a user or a group with
+  name "*".
+  users;;
+    Comma-separated list of trusted users.
+  groups;;
+    Comma-separated list of trusted groups.
+
 ui::
   User interface controls.
   debug;;