I am new to Craft 3 and never set up a local environment with composer, bitbucket and gulp. So I dived into all these things to get my hands on Craft 3. At the moment I am using a shared hosting without a ssh access so I have to deploy my site by using FTP Upload. Is it correct that I just need to upload the entire Craft folder with all its subcategories (/vendors, /config, /modules etc. etc.) after development to the production server and then just to adapt the .env file?
I am a little bit curious about this, since it is recommended not to upload some of the sensitive folders with access to a repo. I know that this due to the fact that nobody should see your logins public. This does not apply for the production server? If I point my subdomain to the /web folder with its index.php on the production server everything should be fine? Just want to be sure.