We have self-service applications running for the pool of emplyees (> 5000) w.o. problems. In fact it’s not an Scriptcase issue, but a php/database issue. The security model in the most advanced setting is complex in that way that the end-user needs to maintain a setting for each and every application. access, read, update, insert, etc. Loads and loads of checkboxes.
That’s why we have made our own model where we have only 2 options: access and access r/w. With the SC_ macro’s you can set/unset access to modules which works fine for us.
Something about large amount of users: we have created some applications in the past (somewhere in 2001) and had to support 8500 people for a self-service application which went in production on monday morning. Although the full pool was almost immediately trying the application (salary benefit model) we could measure max. 3-4 concurrent users at the peek. There where more people logged on, but they are not doing all the same thing at once. I’m sure that this doesn’t count for situation like the amount of facebook users which are millions.
But to support a huge number of users you can always jump from apache to nginx which will matter or use faster databases. A lot of very large websites are build around CMS’s like Joomla, WP or E107 and rely on a php / mysql stack w.o. problems.