This reminded me I was still going to report this bug, but anyone else should feel free to do so before me: gpg-agent stores your password/-phrase in plain text

This reminded me I was still going to report this bug, but anyone else should feel free to do so before me: gpg-agent stores your password/-phrase in plain text in memory indefinitely. You can clear the cache with some command and they also expire after some time, and gpg-agent will pretend to have forgotten them and prompt you again for the password, but the memory that contains the password is not overwritten and you can still dump the process' memory and retrieve it. Email contents seem relatively benign by comparison...