i don't see any gaping holes. but i suspect that it's overkill. why not just take advantage of unix groups and permissions? it shouldn't be too hard to set things up so that the webserver and you can read the code but they can't. much less complicated, less of a potential performance hit, and it makes it easier for you to still have access to and modify those scripts if necessary.

what would be really nice would be Access Control Lists. if you're using linux there's a kernel patch that will give you ACLs.

anders pearson