Initial page props expose sensitive data in HTML source despite lazy configuration

Precise goal

Determine whether Inertia.js can guarantee that props wrapped in Inertia::lazy() or Inertia.lazy() are never serialized into the initial #page script tag under any rendering mode.

Constraints and uncertainty

The framework documentation warns against placing sensitive data in props and recommends lazy evaluation as mitigation. However, lazy props are only fetched on subsequent Inertia visits, not during the initial page load. Server-side rendering (SSR) still includes all non-lazy props in the HTML response. It remains unclear whether shared data registered via Inertia::share() but wrapped in a lazy closure is fully excluded from the initial payload, or if certain edge cases—such as SSR hydration or partial reloads triggered before the first user interaction—cause premature serialization.

Questions

1. Does Inertia::lazy() on shared data guarantee absence from the initial #page JSON when SSR is enabled?
2. Can a race condition during hydration cause a lazy prop to be included in the initial HTML before the client-side router takes over?
3. Is there a documented mechanism to audit the exact contents of the initial payload across rendering modes without manual page-source inspection?