runtime/secret (Go 1.26): erasing secrets from core dumps + reproducible proof
60 views
Skip to first unread message
Cheikh Seck
Jul 24, 2026, 6:02:37 PM (yesterday) Jul 24
to golang-nuts
Go 1.26's runtime/secret (GOEXPERIMENT=runtimesecret) tags allocations inside secret.Do(f) for erasure — the right layer to stop secrets leaking into crash core dumps. Key takeaway: it marks, doesn't wipe — you must call runtime.GC() right after or you still leak, and it's a no-op off linux/amd64+arm64.
I built a reproducible harness (canary → SIGSEGV → scan the core): control leaks, secret doesn't. Repo + Dockerfile: https://github.com/cheikh2shift/go-snippets/tree/main/secret-demo
Writeup: https://towardsdev.com/runtime-secret-go-1-26s-answer-to-secrets-leaking-in-core-dumps-d884615e971f
I built a reproducible harness (canary → SIGSEGV → scan the core): control leaks, secret doesn't. Repo + Dockerfile: https://github.com/cheikh2shift/go-snippets/tree/main/secret-demo
Writeup: https://towardsdev.com/runtime-secret-go-1-26s-answer-to-secrets-leaking-in-core-dumps-d884615e971f
Reply all
Reply to author
Forward
0 new messages