Copying GC also have to cooperate with this SecureString feature, so you won't accidentally keep hanging secret in heap dump. Old Java API has the tendency to use `char[]` for secrets. You can zero it after use, so old reference will not contain useful data, but you can't protect it from copying GC, so it might still gets leaked in raw heap dump, even after zeroing it out.