Update alert block for composer dependencies (#435)

Update alert block for composer dependencies

src/content/1.7/modules/concepts/composer.md

@@ -108,10 +108,13 @@ correctly you **must not** override its dependencies. Which is why you need to a
 {{% /notice %}}
 
 {{% notice warning %}}
+**Don't forget to include your vendor folder in your release package**
 
-**Don't forget to publish your vendor folder**
+Composer is responsible for downloading your dependencies and creating the autoloader file that your module will need to work properly. Therefore, remember to run `composer dump-autoload -o --no-dev` before you create your package, and make sure you include the `vendor` directory in it.
+{{% /notice %}}
+
+{{% notice warning %}}
+**Don't include development dependencies in your release package**
 
-When using composer the autoload file generated by composer is required for your module to work correctly. So before
-creating your module archive and releasing it don't forget to run `composer dump-autoload -o` (or `composer install --no-dev` if
-you have included production dependencies) so that they will be included in your module.
+Development-only libraries like PHPUnit can pose a security threat in production environments. Make sure that these libraries are imported as "dev dependencies" (`require-dev`) so that they aren't included when you create your release package. If in doubt, **double-check that they aren't  in the `vendor` directory when creating your release package**.
 {{% /notice %}}