This is kind of on purpose (but I'm open to reconsidering), because I didn't want a bunch of composer/upstream libraries showing up in code that we maintain when doing searches and stuff. Was there something you were searching for and wanted to see vendor in the results for?

Not indexing vendor seems fine to me. It was just confusing (and somewhat causing a drop in confidence) that there were more results under "WMF deployed" than "Everything". I usually start with one and then go to "Everything" as a sanity check and to maybe find more places to notify.

Other times, I start with "Everything" and if there's nothing there, stop the search.

I don't have a strong preference for indexing vendor, but I do think we should be consistent.

One small argument in favour could be that it includes wikimedia-developed libraries at versions that we currently use in master of MediaWiki, which we wouldn't find otherwise. E.g. if wikimedia library A has a method that I'd like to remove, but wikimedia library B still uses it at the version MediaWiki master uses - vendor would be the only way to find that.

I think, on balance, I currently lean towards also indexing mediawiki/vendor within the 'Everything' preset. I worry that not doing so might lead to folks inadvertently missing results that would otherwise match their search, and that they might otherwise want to see/know about.

As a personal example from recently: when I was drafting T413901: imagedestroy() is deprecated since PHP 8.5, as it has no effect since PHP 8.0, I did a search of Codesearch's 'Everything' preset in order to try and find any uses of the PHP function imagedestroy() within the MediaWiki ecosystem. I deliberately didn't search under the 'MediaWiki & services at WMF' (ie., WMF-deployed) preset, as I also wanted to see results from (and try and submit issues/patches for some of the occurrences within) non-Wikimedia-deployed code.
However, because I searched under 'Everything' rather than 'MediaWiki & services at WMF', I didn't originally see that the mediawiki/vendor library james-heinrich/getid3 also contains an occurrence of that function (T414875#11531687).

What are others' thoughts? I am very much open to hearing other folks' opinions here.
And, if we want to go ahead with indexing mediawiki/vendor under 'Everything' (I'm happy to submit a patch for it), do folks think that it might be wise to (e.g.) send an email to wikitech-l before doing this, in order to get feedback on this idea from people that don't watch the VPS-project-Codesearch Phab project?