zeroize-audit

To detect optimized-away zeroization of sensitive data, you can audit your source code alongside compiler evidence from LLVM IR and assembly. This process validates that secure wipes survive optimization by checking control-flow dominance and semantic IR across all execution paths.

Compiler optimizations often remove secure memory wiping because dead-store elimination treats zeroization of local variables as unnecessary after their last read. Analyzing LLVM IR and assembly evidence proves whether sensitive data wipes actually survive optimization or are silently removed.

To audit cryptographic code for missing zeroization, you must provide your repository path and the required build context: a C/C++ compile database (compile_commands.json) or a Rust Cargo manifest. This enables source scanning and LLVM IR/assembly analysis.

You can verify heap and stack retention risks for sensitive data by scanning for absent or partial zeroization and missing cleanup across all execution paths. The audit generates PoC-backed validation and outputs structured JSON plus a markdown report with IR/ASM/CFG evidence.

The best way to prove sensitive wipes survive optimization is combining source-level scanning with mandatory compiler-level evidence from LLVM IR and assembly. This approach detects insecure heap allocation patterns and validates proof-of-concept programs for security-critical cleanup logic.