Copied from https://github.com/ansemjo/tinyssh-convert/blob/9028c16d99c6ab36aa3e51ac4f3c0b505ebfdff5/utilities.h
--- compat/recallocarray.c
+++ compat/recallocarray.c
@@ -73,8 +73,11 @@ recallocarray(void *ptr, size_t oldnmemb, size_t newnmemb, size_t size)
 	} else
 		memcpy(newptr, ptr, newsize);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ptr, oldsize, 0, oldsize);
+	memzero(ptr, oldsize);
 #elif defined(__NetBSD__)
 	explicit_memset(ptr, oldsize, 0);
 #else
--- compat/siphash.c
+++ compat/siphash.c
@@ -132,8 +132,11 @@ SipHash_End(SIPHASH_CTX *ctx, int rc, int rf)
 
 	r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ctx, sizeof(*ctx), 0, sizeof(*ctx));
+	memzero(ctx, sizeof(*ctx));
 #elif defined(__NetBSD__)
 	explicit_memset(ctx, sizeof(*ctx), 0);
 #else
--- gotwebd/auth.c	2026-02-11 01:33:56.000000000 +0800
+++ gotwebd/auth.c	2026-02-12 01:55:08.000000000 +0800
@@ -390,10 +390,14 @@
 	    " SameSite=Strict;%s Path=%s; HttpOnly; Max-Age=%llu\r\n", token,
 	    env->auth_config == GOTWEBD_AUTH_SECURE ? " Secure;" : "",
 	    srv->gotweb_url_root, validity);
+
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-       memset_s(token, sizeof(*token), 0, sizeof(*token));
+        memzero(token, sizeof(*token));
 #elif defined(__NetBSD__)
-       explicit_memset(token, sizeof(*token), 0);
+        explicit_memset(token, sizeof(*token), 0);
 #else 
         explicit_bzero(token, strlen(token));
 #endif
--- gotwebd/gotwebd.c	2025-09-30 01:05:15.000000000 +0800
+++ gotwebd/gotwebd.c	2025-09-30 10:57:33.000000000 +0800
@@ -1021,8 +1021,11 @@
 	    secret, sizeof(secret)) == -1)
 		fatal("main_compose_auth GOTWEB_IMSG_AUTH_SECRET");
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(secret, sizeof(*secret), 0, sizeof(*secret));
+	memzero(secret, sizeof(*secret));
 #elif defined(__NetBSD__)
 	explicit_memset(secret, sizeof(*secret), 0);
 #else