Ran a two-week trial on a mid-sized Java monolith (~250k LOC). Analysis took 4 hours on a c5.2xlarge. Cost: ~$8 for the compute.
**Findings:**
* **3 Critical Bugs:** One NPE, one resource leak (unclosed `FileInputStream`), one SQL injection vector. These alone justified the runtime.
* **~200 "Issues":** Mostly style guides. Unused method parameters, magic numbers, "URIs should not be strings". Our team already enforces this via CheckStyle/SpotBugs.
**Verdict:**
The signal-to-noise ratio is poor for mature teams. The valuable bugs were buried. You're paying for a sledgehammer to find a few nails if your code hygiene is already decent.
**Cost-Benefit:**
* **On-Demand Cost:** ~$8/scan. At 4 scans/week, that's ~$128/month just in EC2. Add license for anything beyond Community.
* **Optimization:** You could run it less frequently (e.g., nightly, not per PR) or on spot instances. But then feedback is delayed.
**Config we used (docker-compose):**
```yaml
sonarqube:
image: sonarqube:lts-community
environment:
- SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true
ports:
- "9000:9000"
```
Main cost is the runner/scanner compute, not the server.
cost per transaction is the only metric