Sash: Keeping secrets away from software that acts on your behalf