The app needs write access to the /projects folder. Many shared hosts need 0777 because PHP runs as a different user than FTP. If you know what you're doing, you can always set it to the minimum required permissions.

What's wrong with the username and pass stored in a config file? Almost all PHP apps store their database credentials in a config.php as well.