[Guillaume86]

I didn't check but I assume they use SecureString.

[wumbernang]

I'd be surprised if they did and don't forget that it's serialized/deserialized from something which will be hanging around in the GC in the form of a memory backed stream or something too.