PHP .gitignore template

/vendor is the dependency directory, restored by the package manager from the manifest. It is anchored to the root with a leading slash, which is deliberate: a project that keeps its own vendored assets in a nested folder of the same name is not affected. The same reasoning as every other language applies, with one extra wrinkle: the vendor directory contains a generated autoloader that hard codes paths, so a committed copy can break on a machine with a different layout.

composer.lock is where this template makes a choice you may want to reverse. The lockfile records the exact resolved version of every package. For an application, that is the only thing standing between your tested dependency set and whatever the resolver decides on the day you deploy, so the near universal advice is to commit it. Only a library, whose consumers resolve their own tree, has a reason to leave it out.

.env holds the database credentials, mail configuration and API keys for a local install, and this template ignores it correctly. The companion habit that makes this work is committing a .env.example with the same keys and empty values, so a new developer knows what to fill in without you having to send anything privately.

storage/*.key is a small rule with a large consequence. That path holds application encryption keys, and a leaked one lets anyone decrypt session cookies and any data the application encrypted at rest. The Homestead.json and Homestead.yaml rules cover local virtual machine configuration that describes one developer's folder layout.

The rest is caches and logs: *.cache, .phpunit.result.cache, npm-debug.log and yarn-error.log. node_modules appears here too, because a PHP application with a frontend build step will have one, and the general rule about restoring rather than committing dependencies does not change with the language.