Bringing Semgrep's static analysis to Windows developers

Outcome

Semgrep delivered Windows support to its customer base three months ahead of schedule. The internal beta ran seamlessly across five to six customers in different environments, in the US and globally, with no back-and-forth on first release. Windows had been a five-year ask: the majority of professional developers use Windows machines, and without native support Semgrep had been unable to reach engineering teams on the US east coast, in EMEA, or in the wider enterprise market.

I can strongly recommend working with Tarides! Faced with a complex and ambitious project, Tarides easily divided it into smaller milestones and set clear expectations from the get-go. Their organisational skills and impressive responsiveness kept us up-to-date every step of the way.

We chose Tarides partly because of their long history with the OCaml ecosystem, and working with them has let us collaborate closely with the community, learning more about their processes and what's on the language's roadmap. Forming stronger ties with the OCaml community has been a great benefit of working with Tarides.

The outcome of our collaboration went way above our expectations! Thanks to Tarides, we were able to complete our project three months ahead of schedule. The beta that the team built has been working seamlessly, and we have received great customer feedback. We have been able to deliver the product early, unlocking new opportunities and markets for us as we expand our offer to new users.

Milan, Product Manager, Foundations Team, Semgrep

Approach

The engagement ran across three phases of escalating scope:

1. A ten-day initial collaboration in autumn 2025, to validate the working relationship and scope the larger effort.
2. A three-month Windows port, where Tarides took the complex, tangled problem of cross-platform OCaml support and broke it down into clear milestones with regular progress updates.
3. A follow-on phase, now in flight, extending the work into the next set of features.

Tarides' role as a long-standing maintainer of core OCaml open-source libraries was central. Many of the dependencies that needed changes for Windows were ones Tarides already stewarded, which collapsed what would otherwise have been a months-long process of coordinating with external maintainers. Tarides' engineers also embedded closely with Semgrep's staff OCaml engineer, sharing roadmap context and OCaml community insight that strengthened Semgrep's own platform decisions.

Challenge

Semgrep's analysis engine is written in OCaml, a language with a small but talented community. Hiring OCaml engineers at the rate Semgrep needed to expand was a known bottleneck, and Windows support added demands that went beyond product engineering: it required deep coordination with the OCaml open-source ecosystem to ensure every dependency in Semgrep's stack worked reliably on Windows. Semgrep had the budget and the appetite, but lacked the in-house bandwidth and the ecosystem reach to drive the work end-to-end on its own timeline.