Go's runtime/secret: wiping sensitive memory is harder than it looks

The most expensive thing in a system I used to work on was 32 bytes long. Leak it before a certain moment and it would have taken millions ($) with it. Not the servers, not the data, not the code. Literally just the bytes. They sat in the memory of a Go process, waiting for the garbage collector to get around to them. Eight years in tech, a good part of it around security, taught me enough to know my way around this problem, even if systems programming is a place I visit rather than call home. Still, the thought showed up uninvited: this secret is just sitting there. Shouldn’t somebody wipe it? ...

August 3, 2026 · 12 min · kqdu