I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of an plethora possible attack vectors. I imagine codebases are harder to compromise since they are usually located on a server which should have better security in general than some flunky website that's vulnerable to SQL injection or other techniques.
However, I need to have a source for this and am having some trouble finding one. I'm not sure if this would be considered opinion-based or off-topic, but I was hoping some of you might know some studies that dig in to this. I would also be happy with some numbers from an article, or a better way of searching for the information.
Specifically I'm looking for cases where the attacker is able to view the code used for the program (for example by gaining access to the developers machine, or breaching a server and having a look at the files).