Disclosure: I’m the founder of Semmle. As noted above, this conversation is a dup but I wanted to answer the questions that came up. Semmle’s core technology is

Disclosure: I’m the founder of Semmle. As noted above, this conversation is a dup but I wanted to answer the questions that came up. Semmle’s core technology is an engine for variant analysis - finding all instances of a mistake that led to an incident, especially for security. Here's how Microsoft uses Semmle: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/ https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerabi... . The engine does support inter-procedural data flow analysis and simulates execution in that sense. For examples of such data flow analysis on Java, see https://lgtm.com/blog/apache_struts_CVE-2018-11776-part2 https://lgtm.com/blog/apache_struts_CVE-2018-11776-part2.