Function open 

pub fn open(
    key: &[u8; 32],
    nonce: &[u8; 16],
    data: &mut [u8],
    tag: &[u8; 16],
) -> Result<(), TagMismatch>

Open data in place. On a bad tag the buffer is wiped, so no unauthenticated plaintext survives the call.