From the installation docs:

# Serendipity ships world-writeable (777) to make installation easier.
# After the install is complete, you should change those base permissions to allow only your web-server user (e.g. nobody) to access the serendipity directory. All subdirectories should be writeable ...