I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of an plethora possible attack vectors. I imagine codebases are harder to compromise since they are usually located on a server which should have better security in general than some flunky website that's vulnerable to SQL injection or other techniques.

However, I need to have a source for this and am having some trouble finding one. I'm not sure if this would be considered opinion-based or off-topic, but I was hoping some of you might know some studies that dig in to this. I would also be happy with some numbers from an article, or a better way of searching for the information.

Specifically I'm looking for cases where the attacker is able to view the code used for the program (for example by gaining access to the developers machine, or breaching a server and having a look at the files).

  • 2
    A good source for such info is the Data Breach Investigations Report
    – paj28
    Feb 1, 2016 at 9:18
  • 1
    This isn't off-topic but I can't find of any good methodology to answer your question. The DBIR cited above would be the closest to an objective global assessment that is available. Never seen papers on how many e.g. Github repos contain malware or on how many servers run purposedly broken code. Feb 1, 2016 at 10:10
  • 1
    @SteffenUllrich Damn, guess I'm still not specific enough. My main interest would be for keys and passwords stored in files in comparison to a database. For example; would it be safer to store a key for a service (let's say... an SMS sending service as example) in the codebase or in a database? This would be mainly server side languages I'm talking about, so no JS or HTML worries. My idea is that, since (I think) codebases are less often compromised (viewed) it would be safer to store them there, than in a database of sorts.
    – Bono
    Feb 1, 2016 at 11:09
  • 1
    @Bono Service keys belong into neither. Any secret credentials should be a part of the configuration. Which leads us to a third attack target: configuration files on the production machine.
    – Philipp
    Feb 1, 2016 at 11:30
  • 1
    While this is an interesting topic the discussion here suggests that the current question is too broad. Therefore I recommend to close it and to create a new question (unless it exists already) about how to store the necessary secrets in the best way. Feb 1, 2016 at 11:36


Browse other questions tagged or ask your own question.