How We Ensured API Keys Never Linger in RAM

Rust's ownership model cleans up memory automatically — but it doesn't overwrite it. A dropped String containing an API key still has its bytes sitting in physical RAM until something else claims that page. The zeroize crate fixes that. Here's every pattern we used in a production secrets vault. The Problem When you store and retrieve API keys in a credentials vault, the sensitive bytes touch several places in memory: The Argon2-derived encryption key (lives for the session) The raw key value as a String (lives during add/retrieve operations) The master password from stdin (lives until validated) Rust's drop frees the allocation, but the OS doesn't zero it — it just marks the page as reusable. A memory dump, cold boot attack, or crash dump can recover the value seconds to minutes after drop . Three Patterns, Applied Pattern 1 — Zeroize on a custom struct with Drop The encryption key is a fixed-size byte array stored in a struct that holds it for the lifetime of the vault session. We im