func (s *Secret) Destroy() {
	defer s.buffer.Destroy()
	s.guard.remove(s)
}
Destroy properly dispenses of the underlying secret stored in secure memory.
package secure
import (
	"errors"
	"sync"
	"github.com/awnumar/memguard"
)
var ErrSecretNotFound = errors.New("Could not find secret to remove it")
var lock *sync.Mutex
var current *Guard
func init() {
	lock = &sync.Mutex{}
	memguard.DisableUnixCoreDumps()
}
type Guard struct {
	secrets []*Secret
	lock    *sync.Mutex
}
type Secret struct {
	guard  *Guard
	buffer *memguard.LockedBuffer
}
func NewGuard() *Guard {
	lock.Lock()
	defer lock.Unlock()
	if current != nil {
		return current
	}
	current = &Guard{
		secrets: []*Secret{},
		lock:    &sync.Mutex{},
	}
	return current
}
func (g *Guard) remove(s *Secret) error {
	if s == nil {
		panic("received a nil secret; should not be possible")
	}
	g.lock.Lock()
	defer g.lock.Unlock()
	placement := -1
	for i, v := range g.secrets {
		if v == s {
			placement = i
			break
		}
	}
	if placement == -1 {
		return ErrSecretNotFound
	}
	g.secrets = append(g.secrets[:placement], g.secrets[placement+1:]...)
	return nil
}
func (g *Guard) Destroy() {
	lock.Lock()
	defer lock.Unlock()
	for _, s := range g.secrets {
		s.Destroy()
	}
	current = nil
}
func (g *Guard) Secret(v []byte) (*Secret, error) {
	g.lock.Lock()
	defer g.lock.Unlock()
	b, err := memguard.NewMutableFromBytes(v)
	if err != nil {
		return nil, err
	}
	s := Secret{
		buffer: b,
		guard:  g,
	}
	g.secrets = append(g.secrets, &s)
	return &s, nil
}
func (g *Guard) Random(size int) (*Secret, error) {
	g.lock.Lock()
	defer g.lock.Unlock()
	b, err := memguard.NewImmutableRandom(size)
	if err != nil {
		return nil, err
	}
	s := Secret{
		buffer: b,
		guard:  g,
	}
	g.secrets = append(g.secrets, &s)
	return &s, nil
}
func (s *Secret) Buffer() []byte {
	return s.buffer.Buffer()
}