To prevent this I suggest that api/.htaccess be renamed api/.htaccess.example . Because this will leave the API in an insecure state, I also suggest that Projeqtor ships with $paramDisableAPI=true in its initial parameters.php file.

The reason for needing to ensure non-overwriting is that api/.htaccess currently specifies AuthUserFile as a relative path... ie relative to ServerRoot which is often set to /etc/httpd (at least on Fedora / Redhat & derivatives). So rather than forcing the use of /etc/httpd/.htpasswd (which is not a good choice on a multi-site server) it would be better for the administrator to be able to specify an absolute path of their choosing... which in turns means that changes to api/.htaccess should persist across upgrades.