Agency wants extra money for static source code analysis — what is this, is it necessary?

I've been managing software projects for years, and this request sounds completely like an attempt to milk extra revenue. Modern software teams hook static analysis tools straight into their CI pipelines so they run automatically on every single commit. Telling a client 'let us check our own work before handover, but you have to pay for it' is simply unacceptable.

Static analysis inspects the code's syntax tree. It flags vulnerabilities in database queries, exposed API keys, or library incompatibilities without running the code. It's useful, but it literally boils down to running a tool and exporting a PDF. Unless it includes a manual line-by-line audit, it technically costs nowhere near 1,800 EUR.

Happened to us in Stuttgart on a B2B portal with a similar budget of 16,000 EUR. They wanted 1,200 EUR, we refused. We accepted the code, paid a freelance senior dev 350 EUR to run an external audit. We then made the agency fix the 8 critical issues found under their warranty obligation.

You can't trust the agency's report anyway. When they run their own tools, they can easily dial down the filters to produce a squeaky-clean report. The auditor and the developer cannot be the same entity. If you're going to spend extra budget, never give it to the agency that built the project.

if we don't get this analysis done at all, will we run into security issues while the system is running? i mean, does skipping it directly break the site or is it only about hidden background bugs?

Open your contract right now and read the delivery acceptance criteria. If it mentions delivering 'secure code adhering to industry standards', demand this report as a mandatory quality document without paying an extra dime. If they refuse, don't pay anything extra, just wait for the handover.

def do not pay. they will just push one button to run a tool and hand you a pdf file. total waste of money makes way more sense to get an outsider to inspect it after delivery.

Under the principles of contract for work (Werkvertrag) in German law, the contractor is obligated to deliver a defect-free product. Any issues revealed by static code analysis are essentially flaws that should have been remediated prior to delivery. Passing this auditing cost onto the client is legally very questionable.

let me write how it's done in practice. takinng notes for two weeks yields better results than a six-month estimate.

i'm also curious if anyone does it differently.

You're right. The cheapest quote is usually the least thought-out one.

If I were you, I'd go this route.

Timely topic.

I'm curious too.

Don't miss this: The biggest time-waster for us was not knowing who had the final say.

Solutions that work at a small scale collapse when you grow; I learned this late. If you post the result here it will help others too.

We experienced almost the exact same thing last year. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Just leaving this note, it might be useful.

Same here.

I completely agree. Everyone rushing into static code analysis gets stuck at the same point.

Hasty decisions become decisions you have to fix six months later. That's all, sorry if I went on too long.

Same here. Mistakes made on the static code analysis side are usually reversible but expensive.

This is my opinion, I'm not claiming it's absolute truth.

Just a heads-up. If acceptance criteria aren't written, when the work is done is open to debate.

Don't hesitate to ask; those who don't ask always pay more. Correct me if I'm wrong.