#Assume "core" by default When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit, except for app/etc/env.php)

Trying to compare to a fresh install likely won't work: Consider the vendor folder. It has stuff from Magento itself, but if you ever add a module from a 3rd party, it also goes in the vendor folder. (In fact, I recommend adding your custom site changes this way as well).

However, your problem (I believe) is solved if you only let people commit certain files (as I've listed above). This way, you know that they aren't overriding core files. See GIT and deployment strategies (I recommend Vladimir's answer)

Assume "core" by default

When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit, except for app/etc/env.php)

Trying to compare to a fresh install likely won't work: Consider the vendor folder. It has stuff from Magento itself, but if you ever add a module from a 3rd party, it also goes in the vendor folder. (In fact, I recommend adding your custom site changes this way as well).

However, your problem (I believe) is solved if you only let people commit certain files (as I've listed above). This way, you know that they aren't overriding core files. See GIT and deployment strategies (I recommend Vladimir's answer)

#Assume "core" by default When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit, except for app/etc/env)

Trying to compare to a fresh install likely won't work: Consider the vendor folder. It has stuff from Magento itself, but if you ever add a module from a 3rd party, it also goes in the vendor folder. (In fact, I recommend adding your custom site changes this way as well).

However, your problem (I believe) is solved if you only let people commit certain files (as I've listed above). This way, you know that they aren't overriding core files. See GIT and deployment strategies (I recommend Vladimir's answer)

#Assume "core" by default When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit, except for app/etc/env.php)

Trying to compare to a fresh install likely won't work: Consider the vendor folder. It has stuff from Magento itself, but if you ever add a module from a 3rd party, it also goes in the vendor folder. (In fact, I recommend adding your custom site changes this way as well).

However, your problem (I believe) is solved if you only let people commit certain files (as I've listed above). This way, you know that they aren't overriding core files. See GIT and deployment strategies (I recommend Vladimir's answer)

#Assume "core" by default When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit)

#Assume "core" by default When you initially download Magento through composer, it creates all of those folders and files. This means that all of those can be updated by Magento.

The only safe files to modify are:

• composer.json and composer.lock
• anything in the app folder
• as well as any files you've manually created in the root folder (such as nginx.conf or .gitignore)

(These also happen to be the same files you should commit, except for app/etc/env)

Trying to compare to a fresh install likely won't work: Consider the vendor folder. It has stuff from Magento itself, but if you ever add a module from a 3rd party, it also goes in the vendor folder. (In fact, I recommend adding your custom site changes this way as well).

However, your problem (I believe) is solved if you only let people commit certain files (as I've listed above). This way, you know that they aren't overriding core files. See GIT and deployment strategies (I recommend Vladimir's answer)