# Integration with sonarcloud and Github advanced security not working **URL:** \ **Category:** SonarQube Cloud\ **Created:** [March 14, 2025, 10:51am UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802 "2025-03-14T10:51:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![binte](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@binte](https://community.sonarsource.com/u/binte)\ **Post date:** [March 14, 2025, 10:51am UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/1 "2025-03-14T10:51:10Z")
Hi there! I am having issues integrating Sonar Cloud with GitHub Advanced Security on a private repository (I am a paid subscriber). Here’s a brief description of the environment and the setup: - ALM used GitHub - CI system used Azure DevOps - Languages of the repository Terraform, YAML, Bash, Powershell - Description of the problem PR decoration works fine, and I do get the findings in Sonar Cloud dashboard: ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/4/a/4aa41220a9b29d3b5ba1c7b9f2b5e306dd77e235.png) … but the alerts are not showing up in GitHub Advanced Security, where I already have other tools sending findings (like Trivy). Screenshot below presents the total findings for the main branch: ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/d/a/dab7126cf41a325b1547e778bc62a71b78e90a9f.jpeg) Any idea what I might be doing wrong? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 17, 2025, 10:14am UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/2 "2025-03-17T10:14:18Z")
Hey there. Only issues [related to security](https://docs.sonarsource.com/sonarqube-server/latest/user-guide/issues/security-issues-in-devops-platform/) are synced with GitHub Advanced Security. > When you analyze a project in SonarQube, the detected security issues are displayed on the GitHub interface as code scanning alerts if set up in your system. It looks like you only have issues related to reliability and maintainability, which are not pushed to GHAS. ---
**Author:** ![binte](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@binte](https://community.sonarsource.com/u/binte)\ **Post date:** [March 17, 2025, 11:22am UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/3 "2025-03-17T11:22:50Z")
Hi Colin, thanks for your reply! I had a look at what you hinted me, and it doesn’t seem to be the case: ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/5/9/59b9bd829020fb194c642bdf1d29f436a92a1974.png) ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 17, 2025, 1:11pm UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/4 "2025-03-17T13:11:26Z")
Those are [Security Hotspots](https://docs.sonarsource.com/sonarqube-cloud/digging-deeper/security-hotspots/), which don’t count. Only issues with the issue type `Vulnerability` are synced to GHAS. > [@binte](#): > > ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/4/a/4aa41220a9b29d3b5ba1c7b9f2b5e306dd77e235.png) > > image897×193 17.2 KB Based on your screenshot here (0 Security), none of those issues meet that criteria! ---
**Author:** ![binte](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@binte](https://community.sonarsource.com/u/binte)\ **Post date:** [March 17, 2025, 1:27pm UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/5 "2025-03-17T13:27:08Z")
Isn’t this configurable? I would prefer to have all the findings under the GitHub Advanced Security ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 18, 2025, 3:54pm UTC](https://community.sonarsource.com/t/integration-with-sonarcloud-and-github-advanced-security-not-working/136802/6 "2025-03-18T15:54:54Z")
It’s not configurable today. It’s not the first time we get this request > [@Sonar Cloud and GitHub Advanced Security integration](https://community.sonarsource.com/t/sonar-cloud-and-github-advanced-security-integration/108496): > > Hello Sonar Community, Our organization has been leveraging the [integration between Sonar and GitHub Advanced Security](https://www.sonarsource.com/blog/review-security-vulnerabilities-with-github-code-scanning/) to enhance the security posture of our projects. However, we’ve encountered a limitation that we’re hoping to overcome with your assistance. At present, the integration is configured to report only ‘vulnerabilities’ to GitHub’s code scanning alerts. While this is highly valuable, our goal is to obtain a more comprehensive overview of code quality and security issues directly w… So I’ve flagged this to make sure we record the interest here.