WEBHOOK_SECRET is now set. Let me verify my server action reads it correctly.

The secure setup is complete. Here's what's now in place:

• app/get-started/actions.ts — a "use server" action that reads WEBHOOK_SECRET from process.env, attaches it as webhookSecret to the payload, and forwards everything to Formspark. The secret only ever exists on the server and is never sent to the browser.
• app/get-started/page.tsx — the form now calls submitGetStartedForm(submitData) instead of fetching Formspark directly. All existing fields (name, phone, email, property details, listing URL, pricing objective, preferred contact, platform presence, consent) are passed through unchanged.

The WEBHOOK_SECRET env var you added is wired in, and the action gracefully returns an error message if it's ever missing. This keeps the credential off the client entirely while still delivering it to your webhook with each submission.

The JsonLd component already injects safely via the DOM. The remaining culprit is the next/script <Script> tag for Google Tag Manager — in this runtime it renders a raw <script> during render, which triggers the warning. I'll move GTM loading into a client component that injects it via the DOM, matching the JsonLd pattern.

Now update the layout to use this component, replace the GTM <Script>, and remove the now-unused next/script import.

Now swap the imports — add the GoogleTagManager import and remove the unused Script import.

The error came from the next/script <Script> component, which renders a raw <script> tag during render and trips this runtime's warning. I replaced it with a new GoogleTagManager client component that injects GTM into document.head via a useEffect (mirroring the existing JsonLd pattern), and removed the now-unused next/script import. The <noscript> fallback iframe is left intact since it's valid markup and not a rendered script tag.