They should do it only in situations where it doesn't change the program behavior. I use memset frequently in C just to be safe, but if it's written to later on

They should do it only in situations where it doesn't change the program behavior. I use memset frequently in C just to be safe, but if it's written to later on before it's ever read from, the compiler can optimize that away. I'm guessing their recommendation here is if you did something like char* plain_text = malloc(size); ///do stuff with plain_text memset(plain_text, 0, size); free(plain_text); For most programs that last memset is unnecessary (and may even be unnecessary according to the standard, but it's probably implementation defined, not undefined behavior) and it makes sense for the compiler to optimize it away. But for crypto purposes you have to be afraid of someone being able to read plain_text later, so the memset is important