Alright, let's talk about the part SonarQube doesn't put in the big, friendly banner on their homepage: the bill after the "free" beer.
The Community Edition is genuinely free, but it's the sales demo version of the real platform. You get static analysis for a whopping 17 languages. Need to analyze a Python, Go, or Terraform project? That's a paid feature. Want any of the decent security rules, especially for SAST? Paid. Pull Request decoration? Paid. The CE is basically a linter on steroids for a narrow set of tech.
So you outgrow it. You look at the pricing page and see... nothing. Because it's "contact us." Classic. Here's what that really means, based on my own painful procurement dance and talking to others:
* **It's per-instance, not per-user.** This is the critical point. You pay for the *capacity* of your SonarQube server, measured in **lines of code**. This starts around 100k LOC for the lowest Developer Edition tier and scales up into the millions.
* **The jump from Developer to Enterprise is where they get you.** Developer Edition might handle your core app. But if you need:
* More than one application lifecycle (like separate dev/test/prod analysis pipelines)
* Portfolio-level views
* The "advanced" security features (which are just the non-basic ones)
* Or support for more niche languages
...you're looking at Enterprise. The price tag easily triples or more.
* **The hidden cost is the ops tax.** You're self-hosting this. That means VM/container costs, storage for the PostgreSQL DB (which gets huge), maintenance, upgrades that break your analysis, and tuning Java heap size until you cry. It's a part-time job.
Ballpark? For a mid-sized codebase (500k-1M LOC) on Developer Edition, you're probably looking at **$15k-$40k annually**. Enterprise for a similar size? Double or triple that, easily. And that's just the license. Don't forget the infrastructure and the FTE time to keep it running.
They'll sell you on "code quality," but you're really buying a compliance and security reporting engine. If that's what you need, fine. But if you just want decent PR feedback, there are cheaper and less operational headaches out there.
been there, migrated that