Personally I do it like this.
app.js
createInertiaApp({
// config
}).then(() => {
document.getElementById('app').removeAttribute('data-page');
});
ssr.js
createServer((page) => createInertiaApp({
// config
}).then((app) => {
const appRender = app;
appRender.body = appRender.body.replace(/data-page=".*?"/, '');
return appRender;
}));
This will remove the data-page attribute after rendering the page.
Just remind, the data has to be send to the page, because that's how Inertia works. Do NOT send any sensitive information to the front-end which you're trying to hide. I just like a clean document code which is the reason why I am doing it.