1: Don't keep it in memory. If you have to, keep it in memory for as short as time as possible and scrub it afterwards. For example, password fields. 2: If y

1: Don't keep it in memory. If you have to, keep it in memory for as short as time as possible and scrub it afterwards. For example, password fields. 2: If you generate crash dumps, scrub the dumps when you generate them. Some crash reporting services offer to do this automatically. 3: If you are writing anything client/server, where you control the server and the client runs on a users machine, never trust the client. Expect that it has been hacked, is being debugged, and is actively hostile.