--- title: runtime/secret: Go 1.26’s Answer to Secrets Leaking in... description: Go 1.26 introduces the experimental `runtime/secret` package to prevent sensitive data from appearing in core dumps. When a process crashes under... canonical: https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: runtime/secret: Go 1.26’s Answer to Secrets Leaking in Core Dumps | daily.dev og:description: Go 1.26 introduces the experimental `runtime/secret` package to prevent sensitive data from appearing in core dumps. When a process crashes under... og:url: https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z og:image: https://api.daily.dev/og/posts/4RMroBE3Z.png og:image:alt: runtime/secret: Go 1.26’s Answer to Secrets Leaking in Core Dumps og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # runtime/secret: Go 1.26’s Answer to Secrets Leaking in Core Dumps **[Medium](https://daily.dev/sources/medium_js)** · 9 min read · 3 upvotes · 0 comments ## Summary Go 1.26 introduces the experimental `runtime/secret` package to prevent sensitive data from appearing in core dumps. When a process crashes under `GOTRACEBACK=crash`, the kernel writes a full memory snapshot to disk — including plaintext secrets like API keys. The new `secret.Do()` function wraps a closure so the runtime tracks and erases heap allocations made inside it during the next GC cycle. A critical caveat: erasure only happens on GC, so `runtime.GC()` must be called immediately after `secret.Do()` returns to guarantee the data is purged before a crash can capture it. The feature is Linux-only (amd64/arm64), requires the `GOEXPERIMENT=runtimesecret` build flag, does not protect globals, and is not covered by the Go 1 compatibility promise. A working proof-of-concept test demonstrates the control case leaking a canary value and the protected case not leaking it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use Go's new runtime/secret package to keep secrets out of core dumps? Wrap the code that decodes or holds the secret inside secret.Do(func(){...}), then call runtime.GC() immediately after Do returns. Do marks heap allocations made inside the closure for erasure, but the bytes are only physically wiped on the next garbage collection cycle, so calling GC() right away is required to guarantee erasure before a crash occurs. It requires building with GOEXPERIMENT=runtimesecret and only works on linux/amd64 or linux/arm64. _daily.dev surfaces practical writeups like this for engineers hardening Go services against secret leaks._ ### Why would a secret still appear in a core dump even after calling secret.Do in Go 1.26? Because secret.Do only marks allocations for erasure on return; it does not zero the memory immediately. The actual purge happens on the next garbage collection cycle, so if the process crashes in the window between Do returning and a GC running, the still-live buffer survives intact into the core dump. Calling runtime.GC() right after Do closes that window by forcing collection while the process is healthy. _Teams debugging leaked credentials in crash files can track fixes like this via daily.dev._ ### Does Go's runtime/secret experiment protect package-level global variables from appearing in core dumps? No, only heap allocations made inside the secret.Do closure are tracked by the runtime's erase logic. A package-level var key []byte is invisible to this mechanism, so storing a secret as a global makes secret.Do do nothing to protect it. The experiment is also best-effort overall, since pointer addresses can still leak into GC metadata buffers, and it is not covered by the Go 1 compatibility promise. _daily.dev helps developers stay ahead of experimental Go features and their sharp edges before shipping to production._ ## Similar posts on daily.dev - [The Goroutines That Refuse to Die — and How Go 1.26 Finally Made Them Visible](https://daily.dev/posts/the-goroutines-that-refuse-to-die-and-how-go-1-26-finally-made-them-visible-d8q8hxxfn) · Medium · 2 upvotes · 0 comments - [Detecting goroutine leaks in modern Go](https://daily.dev/posts/detecting-goroutine-leaks-in-modern-go-luv5ga3m1) · Anton Zhiyanov · 24 upvotes · 1 comments - [cloud security, system engineering and compilers](https://daily.dev/posts/cloud-security-system-engineering-and-compilers-sxfl15jgp) · Lobsters · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"runtime/secret: Go 1.26’s Answer to Secrets Leaking in Core Dumps","url":"https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z"},"datePublished":"2026-07-28T07:36:45.808Z","dateModified":"2026-09-14T07:16:15.273Z","description":"Go 1.26 introduces the experimental `runtime/secret` package to prevent sensitive data from appearing in core dumps. When a process crashes under...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9009fbdf8ad3bd73294300982dbfd5ae?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9009fbdf8ad3bd73294300982dbfd5ae?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"runtime/secret: Go 1.26’s Answer to Secrets Leaking in Core Dumps"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/runtime-secret-go-1-26-s-answer-to-secrets-leaking-in-core-dumps-4rmrobe3z#faq","mainEntity":[{"@type":"Question","name":"How do I use Go's new runtime/secret package to keep secrets out of core dumps?","acceptedAnswer":{"@type":"Answer","text":"Wrap the code that decodes or holds the secret inside secret.Do(func(){...}), then call runtime.GC() immediately after Do returns. Do marks heap allocations made inside the closure for erasure, but the bytes are only physically wiped on the next garbage collection cycle, so calling GC() right away is required to guarantee erasure before a crash occurs. It requires building with GOEXPERIMENT=runtimesecret and only works on linux/amd64 or linux/arm64. daily.dev surfaces practical writeups like this for engineers hardening Go services against secret leaks."}},{"@type":"Question","name":"Why would a secret still appear in a core dump even after calling secret.Do in Go 1.26?","acceptedAnswer":{"@type":"Answer","text":"Because secret.Do only marks allocations for erasure on return; it does not zero the memory immediately. The actual purge happens on the next garbage collection cycle, so if the process crashes in the window between Do returning and a GC running, the still-live buffer survives intact into the core dump. Calling runtime.GC() right after Do closes that window by forcing collection while the process is healthy. Teams debugging leaked credentials in crash files can track fixes like this via daily.dev."}},{"@type":"Question","name":"Does Go's runtime/secret experiment protect package-level global variables from appearing in core dumps?","acceptedAnswer":{"@type":"Answer","text":"No, only heap allocations made inside the secret.Do closure are tracked by the runtime's erase logic. A package-level var key []byte is invisible to this mechanism, so storing a secret as a global makes secret.Do do nothing to protect it. The experiment is also best-effort overall, since pointer addresses can still leak into GC metadata buffers, and it is not covered by the Go 1 compatibility promise. daily.dev helps developers stay ahead of experimental Go features and their sharp edges before shipping to production."}}]} ```