[phoboslab]

The app needs write access to the /projects folder. Many shared hosts need 0777 because PHP runs as a different user than FTP. If you know what you're doing, you can always set it to the minimum required permissions.

What's wrong with the username and pass stored in a config file? Almost all PHP apps store their database credentials in a config.php as well.

[yeukhon]

I don't get it. 0777 is already the broadest permission you can give. So what is this minimum required permission?

I haven't done much FTP or shared hosts since, maybe, 7-8 years, but I remember Wordpress has the same 0777 is bad practice for many years and hasn't changed.

777 is never a good option.

[1]: http://codex.wordpress.org/Changing_File_Permissions#Shared_...

Anyway, these days, for a couple dollars you can have a really really good cloud hosting service.