Copied from https://github.com/ansemjo/tinyssh-convert/blob/9028c16d99c6ab36aa3e51ac4f3c0b505ebfdff5/utilities.h
--- compat/recallocarray.c
+++ compat/recallocarray.c
@@ -73,8 +73,11 @@ recallocarray(void *ptr, size_t oldnmemb, size_t newnmemb, size_t size)
 	} else
 		memcpy(newptr, ptr, newsize);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ptr, oldsize, 0, oldsize);
+	memzero(ptr, oldsize);
 #elif defined(__NetBSD__)
 	explicit_memset(ptr, oldsize, 0);
 #else
--- compat/siphash.c
+++ compat/siphash.c
@@ -132,8 +132,11 @@ SipHash_End(SIPHASH_CTX *ctx, int rc, int rf)
 
 	r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ctx, sizeof(*ctx), 0, sizeof(*ctx));
+	memzero(ctx, sizeof(*ctx));
 #elif defined(__NetBSD__)
 	explicit_memset(ctx, sizeof(*ctx), 0);
 #else
--- gotwebd/auth.c
+++ gotwebd/auth.c
@@ -390,8 +390,10 @@ logged_in:
 	    " SameSite=Strict;%s Path=%s; HttpOnly; Max-Age=%llu\r\n", token,
 	    env->auth_config == GOTWEBD_AUTH_SECURE ? " Secure;" : "",
 	    srv->gotweb_url_root, validity);
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
 #ifdef __APPLE__
-       memset_s(token, sizeof(*token), 0, sizeof(*token));
+       memzero(token, sizeof(*token));
 #elif defined(__NetBSD__)
        explicit_memset(token, sizeof(*token), 0);
 #else 
--- gotwebd/gotwebd.c
+++ gotwebd/gotwebd.c
@@ -1400,8 +1400,11 @@ gotwebd_configure(struct gotwebd *env, uid_t uid, gid_t gid)
 	    secret, sizeof(secret)) == -1)
 		fatal("main_compose_auth GOTWEB_IMSG_AUTH_SECRET");
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(secret, sizeof(*secret), 0, sizeof(*secret));
+	memzero(secret, sizeof(*secret));
 #elif defined(__NetBSD__)
 	explicit_memset(secret, sizeof(*secret), 0);
 #else 
