Explanation of app/code vs vendor directories please

Magento 2 advocates the use of composer for managing modules, when you install a module through composer it is added to vendor/<vendor-name>/<module>.

You should not edit any code inside the vendor folder. If you’re developing your own module or if you want to continue development of an existing module you add your files or clone a git repo to app/code/<vendor-name>/<module>.

If you later want to distribute this custom module you initialize a git repo and create a composer package. Now others will be able to download and install your module as a composer package, in their <vendor> folder.

Take note that in Magento 2x, You should not touch the vendor folder because the core modules of magento resides in that folder. and if you modify a single code or module in that folder, and you are planning in the future to upgrade your magento to the latest version available. You will experience a major problem because when you upgrade magento 2. Those codes or module that you edited in the vendor folder will give a conflict to the new version. The best thing you can do is extend a vendor module for you to be safe. and if your magento installation has no app/code folder. you can manually add it.

The correct way of creating or extending a module is to create it under app/code/vendorname/modulename you can refer to this link: https://www.mageplaza.com/magento-2-module-development/

Hi guys correct me if I'm wrong. but as far with my experience in magento 2. vendor module should not be touched.

Thank you, MazeStricks

I (the original poster) later stumbled on this word from the horse's mouth:

https://community.magento.com/t5/Just-Ask-Alan/Why-two-locations-to-develop-themes/m-p/30147

An excerpt:

Here are some key directories to try and clarify their roles:

• app/design is where to locally develop a theme to have it picked up during development.
• vendor is where things go if you get a "released" package from somewhere (Marketplace, or internally) - Composer downloads into this area.
• pub/static is where files are generated from the theme. These are the files the web browser downloads. All fallback rules, theme inheritance, etc is all resolved by this stage.

... and there's quite a bit more in that same comment, and subsequent Q&A comments.