Is the server running front page extensions? If it is, someone would need a username and password to get to it. Other than that, I can think of no reason the server would serve up the source of the script (unless it's a configuration issue.)

I'm assuming my only solution would be to setup a library below the web route...

Yes, you should store your id & password outside of the web root.