How We Cut Semgrep's Taint Analysis Time by 75%

2026-06-18

To enable interfile taint tracking, Semgrep Pro historically ran taint analysis twice. With the release of improved multicore support in OCaml 5.0, the Semgrep team was able to rearchitect interfile taint tracking to run only once. Using a custom OCaml profiler, the team recorded speedups of up to 75% with this refactor.