[cryptography] Secret<T> wrapper memory hardening

[andresilva]

Extracted from #2640 as a follow-up.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	commonware-mcp	aade287	Jan 08 2026, 03:15 PM

[cloudflare-workers-and-pages]

Deploying monorepo with    Cloudflare Pages

Latest commit:	aade287
Status:	✅  Deploy successful!
Preview URL:	https://836d50d1.monorepo-eu0.pages.dev
Branch Preview URL:	https://andre-secrets-wrapper-harden.monorepo-eu0.pages.dev

View logs

[andresilva]

This is now outdated, I'll update once #2640 is merged.

[codecov]

Codecov Report

❌ Patch coverage is 92.12598% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.20%. Comparing base (57ddd8c) to head (aade287).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
cryptography/src/secret.rs	92.03%	20 Missing ⚠️

@@            Coverage Diff             @@
##             main    #2710      +/-   ##
==========================================
- Coverage   93.21%   93.20%   -0.02%     
==========================================
  Files         371      372       +1     
  Lines      113204   113592     +388     
==========================================
+ Hits       105525   105870     +345     
- Misses       7679     7722      +43     

Files with missing lines	Coverage Δ
cryptography/src/bls12381/dkg.rs	95.45% <100.00%> (ø)
cryptography/src/bls12381/primitives/group.rs	93.43% <100.00%> (+0.39%)	⬆️
cryptography/src/handshake/key_exchange.rs	97.14% <100.00%> (ø)
cryptography/src/secret.rs	93.61% <92.03%> (-6.39%)	⬇️

... and 16 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 57ddd8c...aade287. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.