You could also very easily add one additional command to your deploy script to copy all the web content from the directory being pulled to to the web root, and not have to worry about any accidents.
Or you could set the web root to be that directory.
Hiding it is riskier than just not having it there in the first place. Why blacklist when you can whitelist?