What Not to Commit in a Laravel Project

A Laravel repo should hold the recipe, not the kitchen. The generated and environment-specific parts belong elsewhere.

The .gitignore that covers it#

/vendor
/node_modules
.env
.env.backup
.phpunit.result.cache
/public/build
/public/hot
/storage/*.key
/storage/logs/*.log
Homestead.json
Homestead.yaml

Laravel’s default .gitignore ships most of this. The ones people add by hand are the environment files and the editor/OS noise (.idea, .DS_Store — those belong in your global gitignore, not the project’s).

Why each one stays out#

• vendor/ and node_modules/ are rebuilt by composer install and npm ci from the lock files — which you do commit.
• .env is per-machine by definition and carries secrets. Commit .env.example with the keys and empty values instead.
• public/build is Vite output; it gets rebuilt on every deploy.
• storage/*.key and logs are runtime state, different on every server.

Already committed something?#

git rm --cached -r vendor stops tracking it without deleting your local copy, then commit the removal. If the file carried a secret, that is not enough — the history still has it, and the rotate-first routine applies.