@buherator
This was also fun in Java. I remember digging into the JCE SDK and found that despite a developer's best intentions to zeroize byte buffers, the SDK was cloning them internally into other copies that were encapsulated so you couldn't wipe them...
That was when i gave up on trying to require this as a standard dev practice.