This seems like a really bad idea. I've been in your shoes more
times than I care to admit, so for clients where this situation is a
potential, I've adopted an aggressive strategy for getting payment
for my work. I only deploy what they have paid for. If they demand
to see working code first, that's fine, I deploy it to a subdomain
that I own.
I am up front with my intentions, so there are no surprises. When
they have agreed that the code meets what they need, then when
payment is received (and the check clears) will I push the changes to
their boxes, or if I'm hosting it, to their domain.
Don't feel like you will lose business by demanding something like
this. You deserve to get paid for your quality work!
