Kill tor_strclear() with fire, and replace it with memwipe().
Per nickm, "IMO: delete that function; change its three users to use memwipe".
Not sure about the milestone for this, tentatively setting it to 0.2.7.x, though previously stored client keys for rend services are sanitized using this, so it might be a 0.2.6.x thing.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information