The April 26 Qodana marketing post opens with three figures: $2.41 trillion lost to poor software quality, $4.44 million per data breach, and a "15x at testing, 100x at maintenance" multiplier on the cost of fixing bugs late. Two of those numbers are real. The third has been the Loch Ness Monster of software economics for over a decade, and JetBrains decided this was the week to organize another expedition.
The post traces "100x at maintenance" to a 2010 IBM Systems Sciences Institute study. It links a ResearchGate paper that only cites the figure secondhand. Laurent Bossavit's book The Leprechauns of Software Engineering followed that trail to a dead end. Nobody has produced the original IBM study. The figure itself stitches together ratios from 1970s and 1980s mainframe-era studies, recycled through blog posts for decades.
Tim Menzies and team published a 2016 empirical study tracking 171 software projects from 2006 to 2014. They concluded: "That data held no trace of the delayed issue effect." Treating "15x at testing, 100x at maintenance" as a peer-reviewed fact in 2026 relies on a weak epistemic standard. It feels true in a meeting. It falls apart when you ask for a citation.
The other two numbers check out. CISQ's $2.41 trillion estimate for poor software quality in the US in 2022 is a real macroeconomic figure. However, it bundles cybercrime losses, supply-chain incidents, and technical debt. IBM's $4.44 million average cost of a data breach in 2025 is verifiable. A $10.22 million US-only average sits on top of it.
Neither number says anything specific about running Qodana on your repository. The post never produces a single Qodana customer outcome or lab benchmark. It offers no controlled measurement of bug detection rate, false-positive rate, or time to fix. Every quantitative claim is rented from somebody else's report. The blog reads like a research paper-shaped object with the research scooped out and a pricing page glued to the back.
Strip the macro narrative away and the actual pitch is mundane. Qodana pricing starts at $5 per active contributor per month for the Ultimate tier. The Ultimate Plus tier costs $15 and adds security analysis, taint analysis, and single sign-on. The pricing model docs define an "active contributor" as anyone who pushed a commit to a registered project in the last 90 days. An intern fixing a README typo costs the same as a full-time architect. This uses the same per-seat-by-stealth model every subscription tool converged on.
The Community tier is free, but many features live behind the paywall. You pay for pull request analysis, security checks, and quick-fix automation. Premium linters for JavaScript, TypeScript, PHP, and Go are also gated. The free tier's job is to remind you of the paid one. A typical configuration in a TypeScript repository looks like this:
# qodana.yaml
version: "1.0"
linter: jetbrains/qodana-js:2025.3
profile:
name: qodana.recommended
failureConditions:
severityThresholds:
critical: 0
high: 5
exclude:
- name: All
paths: [dist, node_modules, tests/fixtures]# .github/workflows/code_quality.yml
name: Qodana
on: [pull_request, push]
jobs:
qodana:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Qodana Scan
uses: JetBrains/qodana-action@v2025.3
env:
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}Two footnotes exist that the docs whisper rather than announce. The JavaScript linter will not run without a Cloud project token even on the Community tier. "Fully offline static analysis" is a slogan, not a product. Furthermore, fetch-depth: 0 is required for pull request mode. This inflates clone time on any repository with real history. Anyone running Qodana on an older monorepo learns this once in a continuous integration bill.
Findings return as SARIF format. They surface in pull request comments, GitHub Code Scanning, or Qodana Cloud. A typical hardcoded-secret hit looks like this:
{
"ruleId": "PhpHardcodedSecret",
"level": "error",
"message": { "text": "Hardcoded credential 'sk_live_...' detected" },
"locations": [{
"physicalLocation": {
"artifactLocation": { "uri": "src/Config/Stripe.php" },
"region": { "startLine": 42 }
}
}]
}That is the same finding the JetBrains editor engine already surfaces in real time as a yellow squiggle. Qodana is essentially JetBrains inspections shipped to a build server with a price tag stapled on. The engineering is solid, but the competitive math is grim. GitHub CodeQL is free for public repositories. It ships with Copilot Autofix bundled into Code Scanning.
SonarQube Cloud Free covers private projects up to 50,000 lines of code. It includes branch and pull request analysis, and JetBrains' own March 2026 post concedes that its free Qodana Community tier has no branch analysis. Snyk Code Free gives 100 security scans per month. Semgrep keeps its open-source tool free. At $5 per contributor per month, Qodana Ultimate costs $60 per developer per year, in a market where competitors bundle the same job into your existing platform.
The harder problem is timing. The pre-commit window where static analysis used to dominate is shrinking. AI agents inside the editor catch many obvious patterns at composition time. They flag leftover logs, hardcoded secrets, null references, and copy-pasted fragments. The new GitHub Copilot inline agent in JetBrains editors is the most direct example.
Above the editor, GitHub bundles CodeQL plus Copilot Autofix directly on the platform. Qodana's actual remaining differentiator is bulk repository audit and version-controlled inspection profiles. It is no longer about per-commit feedback. The marketing post mentions none of that. Instead, it reaches for a 2010 IBM citation nobody can produce.
Qodana is a competent product. What it is being sold on is a phantom IBM citation and two irrelevant macro numbers. Its price tier loses to free CodeQL for open-source projects. It also loses to SonarQube Cloud's 50,000-line private quota for solo developers. The product works fine. The pitch relies on an unverified study and a 2026 sales target.