The app needs write access to the /projects folder. Many shared hosts need 0777 because PHP runs as a different user than FTP. If you know what you're doing, you can always set it to the minimum required permissions.
What's wrong with the username and pass stored in a config file? Almost all PHP apps store their database credentials in a config.php as well.
I don't get it. 0777 is already the broadest permission you can give. So what is this minimum required permission?
I haven't done much FTP or shared hosts since, maybe, 7-8 years, but I remember Wordpress has the same 0777 is bad practice for many years and hasn't changed.