As outlined in http://seclists.org/oss-sec/2016/q1/645 , we are potentially vulnerable to remote code execution (the actual bugs trigger heap overflow) as sourcetree for mac bundles version 2.6.4 of git.

Update to a version of git that addresses CVE-2016-2324 and CVE‑2016‑2315 (git 2.4.11, 2.5.5, 2.6.6 and 2.7.4 all have the fix).