Laravel .gitignore Template Explained

Laravel.gitignore is for Laravel applications that install dependencies with Composer and npm. It combines rules similar to the .gitignore that ships with Laravel projects with files from development environments such as Homestead and Vagrant.

The most important entry is .env. Laravel reads the database password, APP_KEY, and mail and payment API keys all from .env, so if this file is committed, every secret of the application is exposed.

Rules explained

Pattern	What it ignores and why
/vendor/node_modules/	DependenciesFolders recreated by composer install and npm install. Commit composer.lock and package-lock.json so everyone installs the same versions.
.env.env.backup.env.production	Environment filesApplication secrets and per-environment settings. Share the list of variables through .env.example; this template does not ignore that file.
public/storagepublic_html/storagestorage/*.key	Storage link and keysThe symlink created by php artisan storage:link and Passport's OAuth private key (oauth-private.key). The link is recreated on each server, and the key is secret.
/public/buildpublic/hotpublic_html/hotnpm-debug.logyarn-error.log	Frontend buildsBuild output from Vite and the hot file that signals the dev server is running. If the hot file is committed, the production server tries to load assets from a dev server that does not exist.
.phpunit.result.cache/.phpunit.cache	Test cachesA cache in which PHPUnit remembers things such as the order of failed tests.
Homestead.yamlHomestead.json/.vagrant.phpactor.json/storage/pail	Development environment and toolsPersonal Homestead settings, Vagrant state, Phpactor settings and Laravel Pail log files.
auth.json	Composer authenticationThe Composer authentication file that stores tokens and passwords for private package repositories.
bootstrap/compiled.phpapp/storage/	Legacy pathsThe compiled file and storage path from the Laravel 4 era. They are not created by recent versions.

Practical notes

• Commit .env.example with placeholders instead of real values.
• The app, framework and logs folders under storage/ contain nested .gitignore files that Laravel ships by default; do not delete them.
• If .env ended up in history, change APP_KEY with php artisan key:generate and rotate the database and API passwords too.

Original template

/vendor/node_modules/npm-debug.logyarn-error.log# Laravel 4 specificbootstrap/compiled.phpapp/storage/# Laravel 5 & Lumen specificpublic/storagepublic/hot# Laravel 5 & Lumen specific with changed public pathpublic_html/storagepublic_html/hotstorage/*.key.envHomestead.yamlHomestead.json/.vagrant.phpunit.result.cache/.phpunit.cache/public/build/storage/pail.env.backup.env.production.phpactor.jsonauth.json

Often used together

More template explanations