somebody can load their own operating system and see unencrypted files, right?
Yes. If you are not using encryption and an attacker gets access to your hardware, they get access to all your data.
Should we store web application files when we are constantly developing in encrypted directory?
That really depends.
If this is a larger company, there should be a policy in place about this. Ask the relevant people about it.
If this is a small company and you are the one responsible for the decision, you need to weight the factors.
- What is the cost of stolen source code? ie: How important is your source code? Is it open-source anyways? Is it something someone else could actually use? Or is it highly specialized software that is unlikely to be useful for anyone? Do you depend on the source being secret for security reasons (security through obscurity)? If the source is stolen, can you use other measures to punish the thief (legal avenues, etc)?
- On the other hand, what is the cost of encryption? Have you measured the performance (my guess is that with decent laptops, it shouldn't be a problem)? How many hours would your developers loose if you used encryption?
After you weighted these factors, you should have an answer.
You could also try to find a middle ground. Eg have two laptops/computers. One encrypted which developers can take where ever they want, and one unecrypted that can only be in the office (ideally a desktop computer, so they are not accidentally removing it). This assumes that the source isn't so important that someone would break into the office (but if we assume that someone would to that, we could also assume that someone might tamper with an encrypted laptop to log the password).