Just setting a string to `null` or calling the GC will not help here. It might delete the reference to the value, but not the value itself. After GC, it may be overwritten, but there is no guarantee that it will happend anytime soon.

What you need instead is a [`SecureString`](https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8). It implements a `Dispose` method. Just be careful about how you get your secret value into the secure string - if you just copy it from an ordinary string you haven't really solved anything.

Do note that you should only think of this as a form of obfuscation. If there is sufficently advanced malware with sufficiently high priviliges on your system, no secrets are safe no matter what fancy C# types you wrap them in.