While on UNIX it’s at least functionally possible to have the auto-updated “working” files in the same folder with the CVS versioned files, it’s generally not a good idea, especially if the files sit on the web without a password. When viewed through a web browser the versioned files are printed as ASCII. If the location is not password protected the web users can read contents of your server side logic files (php, cfm, asp, jsp, etc.). On Windows there’s also conflict with the CVS folder which eventually (when attempting to update subfolders) leads to anomalies if bypassed.

I initially toyed with the idea of placing the versioned and working files into the same folder, but soon realized it’s the best to put the versioned files into their own, non-web-accessible folder, and have the CVS auto-update the working files in a web-folder (which you may want to password protect via your web server configuration).