title: solution to convert to/from SecureString for any strings that could contain ‘secure’ data
body: <p>A code analysis tool (Fortify) flagged some string variables containing potentially secure data in my code as being vulnerable to heap inspection (because of the way .NET handles strings) and recommended conversion to <code>SecureString</code>.</p>
  
  <p>From what I understand, the best way to deal with secure strings is with <code>byte[]</code> which is cleaned up when it goes out of scope, unlike strings. The problem is you have to implement any string-type methods (like <code>replace</code>, etc) for <code>byte[]</code>.</p>
  
  <p><strong>What are the alternatives to using byte[] and rolling my own string methods?</strong></p>