Running dep ensure removes files from vendor/ that is doesn't manage.
For example, I had a third-party shell script contained under vendor, and of course the manifest file from the vendor tool I was previously using. Both were deleted.

Experienced with dep version 76df5ce06d34253ce16abb2204b577ce14efc587.
AFAIU, dep assumes complete control of vendor/, and may indeed blow things away if it feels like it. @sdboyer is this correct? If yes, my intuition is to document that better, somehow.
Yep, @peterbourgon is correct - we treat vendor/ as entirely volatile. It's very hard to do otherwise and keep the tool consistent - especially before we have #121 figured out.
It is definitely worth documenting, though - I'll leave this open for docs purposes?
Closing now that this has been documented in the FAQ.
Most helpful comment
It is definitely worth documenting, though - I'll leave this open for docs purposes?