allocating a new buffer doesn't give any guarantee as you might be given back a just dealocated buffer by the allocator with its original content mostly intact. You need to explicitly scrub any sensitive data yourself before deallocating. At that point you might just reuse the buffer yourself.