Memory persistence of sensitive authentication strings in Dart

Dart handles strings as immutable objects, which presents a specific challenge when implementing least-privilege authentication flows. When sensitive data like OAuth2 tokens or JWTs are retrieved from secure storage and processed, the objects remain in the heap until the garbage collector decides to reclaim the memory.

Because the language does not provide a mechanism to manually zero out or overwrite memory buffers, there is no guarantee that credentials are wiped from RAM immediately after an asynchronous network request completes. This is particularly relevant in high-security environments where memory dumps could expose long-lived session tokens.

Is there a documented pattern in Dart to force the immediate deallocation of sensitive string data, or does using Uint8List with manual clearing mitigate the risk of credentials persisting in the heap longer than necessary?