diff --git a/‎docs/2.directory-structure/1.components.md‎
Lines changed: 24 additions & 0 deletions b/‎docs/2.directory-structure/1.components.md‎
Lines changed: 24 additions & 0 deletions
@@ -491,6 +491,30 @@ Server components (and islands) must have a single root element. (HTML comments
 Props are passed to server components via URL query parameters, and are therefore limited by the possible length of a URL, so be careful not to pass enormous amounts of data to server components via props.
 ::
 
+::note
+Server component props come from the request (URL query or body), so treat them as untrusted input. Nuxt rejects the props most likely to leak through unintentionally: a top-level `as` that the island does not declare (an undeclared prop falls through as an attribute onto the island's root), and, with `vue.runtimeCompiler` enabled, a `template` anywhere in the props. Beyond that, avoid feeding props you have not validated into dynamic component resolution (`<component :is>`{lang=vue}, `h()`, `resolveDynamicComponent()`, or a polymorphic `as` / `asChild` prop), since a string can resolve to any registered component or HTML element.
+
+Props a component does not declare fall through as attributes onto its single root element, so an island whose root is a polymorphic component (e.g. from `reka-ui` / `@nuxt/ui`) can receive attributes you did not bind. Set `defineOptions({ inheritAttrs: false })`{lang=ts} on such islands, or declare the props you accept.
+
+To switch components based on caller input, map a discriminator through an allowlist of imported components rather than passing the raw prop:
+
+```vue
+<script setup lang="ts">
+import type { Component } from 'vue'
+import CardA from './CardA.vue'
+import CardB from './CardB.vue'
+
+const props = defineProps<{ variant: string }>()
+const allowed: Record<string, Component> = { a: CardA, b: CardB }
+const component = allowed[props.variant] ?? CardA
+</script>
+
+<template>
+  <component :is="component" />
+</template>
+```
+::
+
 ::warning
 Be careful when nesting islands within other islands as each island adds some extra overhead.
 ::