diff --git a/docs/source/tutorials/security-model.md b/docs/source/tutorials/security-model.md
index 87098b347..b0658b359 100644
--- a/docs/source/tutorials/security-model.md
+++ b/docs/source/tutorials/security-model.md
@@ -47,7 +47,7 @@ Each template node (the `for` tag, literal `order: `, output `{{i}}`, and so on)
 
 ### maxDepth
 
-[maxDepth][maxDepth] limits how deeply `{% render %}`, `{% include %}`, and `{% layout %}` can nest. Defaults to `128`.
+[maxDepth][maxDepth] limits how deeply `{% render %}`, `{% include %}`, and `{% layout %}` can nest. Defaults to `128`. In sync rendering (`renderSync`), nested tags are driven by `toValueSync`, which recursively resumes each yielded generator on the call stack—deep nesting can overflow it, and `maxDepth` caps that depth. Async `render()` resumes the same tag generators via `toPromise`/`yield` without a deep synchronous call chain, so stack overflow is not a concern there (the limit still applies as a DoS guard).
 
 The `memoryLimit` option was removed; memory usage is not capped in-engine.