In my experience with Claude Code Opus, analyzing or generating files eats the most tokens while thinking is actually surprisingly cheap. I guess, the token-counting is somewhat wrong on purpose to incentivize use of high-effort thinking mode because when you incentivize using lesser models or modes, people get disappointed by the output quality and stop using the service...
So just let it analyze the code base for flaws and bugs in a loop using lots of sub agents for each type of bug or code smell.

The good thing about that method is that it is technically malicious compliance; but it also offers a high degree of plausible deniability and likely yields some actual bug fixes to offer as justification.

Doing it just once every once in a while without fanning out into tons of agents rereading the same files is the non-malicious-compliance way of using AI for bug hunting and usually worth it. Also let it write tests for the found bugs (and properly review those tests using the natural neural network in your head).