# Managing security issues in DevOps platform

This page explains how to view and/or manage the security issues reported by SonarQube in your GitHub or GitLab instance.

## Managing security issues in GitHub <a href="#github" id="github"></a>

When you analyze a project in SonarQube, the detected security issues are displayed on the GitHub interface as code scanning alerts [report-security-alerts](https://docs.sonarsource.com/sonarqube-server/10.6/devops-platform-integration/github-integration/setting-up-at-global-level/report-security-alerts "mention"). When you change the status of a security issue in the SonarQube interface that status change is immediately reflected in the GitHub interface. Similarly, if you change the status of a code scanning alert in GitHub, that change is reflected in SonarQube.

To view and manage your code scanning alerts:

1. In GitHub, go to your repository’s **Security** > **Code scanning alerts** tab.
2. Select **View alerts** to see the full list.

![](https://3001318305-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVhGCsZJo9Ao0Jjyhvpxl%2Fuploads%2Fgit-blob-642fdfa46dbc58dc7a97860bb3f1cee6e7944537%2Fd7b0e151c2f45762bad670fbfda8d8c2ef38c963.png?alt=media)

## Viewing the security issues in GitLab <a href="#gitlab" id="gitlab"></a>

When you analyze a project in SonarQube, the detected security issues are displayed on the GitLab interface as security vulnerabilities [setting-up-at-project-level](https://docs.sonarsource.com/sonarqube-server/10.6/devops-platform-integration/gitlab-integration/setting-up-at-project-level "mention"). When you change the status of a security issue in the SonarQube interface that status change is immediately reflected in the GitLab interface.

{% hint style="warning" %}
If you change the status of a security vulnerability in GitLab, that change is *not* reflected in SonarQube.
{% endhint %}

To view the security vulnerabilities:

* Go to the **GitLab** > **Vulnerability** report page.

{% hint style="info" %}
If your issues appear duplicated (it may be the case after the modification of a file), we recommend using the **Activity** > **Still detected** filter.
{% endhint %}