Both policies were rebuilt on every NewSanitizer() call. This included compiling the chroma syntax-highlight class regex by iterating chroma.StandardTypes and joining ~200 type names into a regex alternation, on every invocation — including from inside the pull request HTTP handler, making it a per-request cost. Move both policies to package-level vars initialized once in init(). NewSanitizer() is now a pair of pointer assignments. This is safe per the bluemonday README: "it is safe to use the policy in multiple goroutines". Signed-off-by: Matías Insaurralde <matias@insaurral.de>