Using subversion for deployment is a common practice. They should be blocking access to the .svn directories via web server configuration.