Pay-as-you-go
Code Security uses the pay-as-you-go billing model. The system settles bills on an hourly basis by calculating the actual consumption of the previous hour and generates a bill. No upfront payment is required. You pay only for the resources that you actually use.
Billing rules
Code Security charges are calculated based on Credit consumption per hour. The system automatically calculates the number of Credits consumed by SAST and SCA scans in the previous hour and generates a bill on a daily basis.
The pay-as-you-go unit price is 1 CNY per 100 Credits.
-
SAST: Billed based on the number of credits consumed. Credits are calculated based on the token consumption of the large language model. The credit consumption varies depending on the scan scenario. For more information, see Billable items.
-
SCA: Billed per dependency package detected. Each dependency package consumes 50 Credits.
Billing cycle
Pay-as-you-go bills are settled once per day (based on UTC+8 time). After settlement, a new billing cycle begins.
Activation and deactivation
You can go to the Code Security purchase page to activate the service. After activation, billing starts automatically when you first use a product feature, such as submitting a scan task.
If you no longer use Code Security, no additional action is required. No fees are incurred when the service is not in use.
Cost optimization
-
Optimize full scan frequency: Full scans cover the entire project and consume more credits. We recommend configuring full scans as needed (for example, once a week) and using incremental scans as the primary scanning method for daily operations.
-
Use incremental scans: Pre-commit scans only scan code snippets or changed parts, consuming far fewer credits than full scans.
-
Leverage the caching mechanism: The system caches scan results for duplicate code segments, avoiding repeated token consumption and reducing actual credit consumption.
FAQ
Does the credit consumption differ significantly between scan scenarios?
Yes, the difference is significant. Incremental scans only scan newly added or changed code, consuming very few credits. Full scans cover the entire project and consume significantly more credits. We recommend configuring full scans at a reasonable frequency and using incremental scans for daily operations.
Does SCA scanning consume credits?
Yes. SCA basic scanning (dependency identification and CVE matching) consumes Credits. Each dependency package consumes 50 Credits.