Hacker News Reader

My guess is that it just uses the existing finalizers and ensures the memory is overwritten.

SetFinalizer is deprecated by AddCleanup: https://pkg.go.dev/runtime#AddCleanup

AddCleanup might be too heavy, it is cheaper to just set a bit in the header/info zone of memory blocks.

Same here, though I think that the GC will do a full run for all "secure" data that is clear regardless of GC timing.