title: How to solve Heap inspection vulnerability for MVC viewmodel?
body: <p>Checkmarx reported a Heap inspection vulnerability regarding having a string for a Password property. This property is part of a model, which gets bound when submitting a login form. Is there a way in ASP.NET MVC to use anything else other than regular string to bind password from the form? </p>
  
  <p>So far I have tried changing the property type to char [] or SecureString, but in that case the form doesn't bind the data to it.</p>
  
  <pre><code>public class LoginModel
  {
      [Required]
      [Display(Name = "User name")]
      public string UserName { get; set; }
  
      [Required]
      [DataType(DataType.Password)]
      [Display(Name = "Password")]
      public string Password { get; set; }
  
      [Display(Name = "Remember me?")]
      public bool RememberMe { get; set; }
  }
  </code></pre>