I wouldn't call this "off-topic", exactly, but there doesn't seem to be a general community banter tag, so... Move it if you need to.
Our general workflow, naturally, is to work locally, then copy the composer files to production and run the update. Occasionally we'll make the production database available to team contributors so they can update their locals, but not routinely since it's not necessary to have every discussion for minor presentational fiddling, etc.
We also keep a GitHub repo so new team contributors have access. But we don't make the database available to the public, naturally, and we ignore a few things in the file tree for similar reasons. That said, we want to make the repo as complete as possible without the needless, sensitive, and private stuff. "Needless" in this case would mean things like cache files.
Following is our current .gitignore file in root. Any suggestions for improvement? Are there glaring security issues? Are we being too strict on the /storage folder? I.e., could we let some child things there through? What about the composer.lock and .json files? What do you do?
*~
## Ignore configuration file (sensitive info) in root folder, of course.
config.php
## Ignore configurable .htaccess in root folder.
/.htaccess
## Ignore user avatars. Needed for local dev and production, but not the public repo.
/assets/avatars/*
## Ignore 'storage' folder and everything in it.
storage/
## Ignore .js and .css cache files in root of 'assets' folder.
/assets/*.js
/assets/*.css
