It's a bit tough to deal with this since javascript doesn't offer any real way to zero a string's memory. The way to do this would be to read from stdin directly into a Buffer object (which is malloc'd separately from the v8 allocator) and to buff.fill(0)/memset(buff, 0) once we're done. I'll definitely work on implementing this. Thanks for pointing this out.