WebAssembly: poison JS object's secrets