zeroize-audit

Compilers remove zeroization code through Dead Store Elimination, an optimization that deletes writes to variables never read again. This leaves sensitive cryptographic keys or credentials retained in stack memory or CPU registers.

Audit sensitive data zeroization by analyzing LLVM IR and assembly outputs to verify control-flow and confirm secrets are not spilled to registers. This detects missing or compiler-optimized zeroization in cryptographic implementations.

Yes, clang is required to perform the assembly-level inspection and LLVM IR comparison needed to detect secret retention. You also need uv, uvx, and jq to run the scripts and process the generated security report.

The best way to verify if secret-wiping functions are optimized away is through evidence-based auditing using LLVM IR and assembly analysis. This confirms if secrets are physically retained on the stack despite source code cleanup routines.

You need assembly-level inspection for memory safety when verifying cryptographic implementations and credential handling for security compliance. It proves whether compiler optimizations removed zeroization patterns that source code review alone cannot detect.