Sourcetree Security Questions

[eight-arm-code]

Hello,

I'm working on a business case to bring in SourceTree on a project for visualizing local git repos/branches, and for that purpose I need answers to some security questions. I've done some research online, but I was hoping to get a more official response direct from Atlassian.

1. What is the purpose of the required login? I found this question asked in your community forum, but it did not have an accepted answer.
2. Can it be configured to use non-cloud-based Git repos such as Gogs, Gitea, or possibly SVN?
3. What data does it collect? Does it store any of the code from the repositories it is managing?
4. Can you share which open source components you might be using under the hood? This will help in the process of vetting the tool's security protocols.

Thanks in advance for your time and attention regarding this matter,

KE Chilton

[Ana Retamal]

Hi! Even if it's not accepted it doesn't mean it's not correct, it just means the author of the question didn't go back to the question and click on the button.

1. I guess you're referring to the registration, that's to comply with our EULA, you can find it at Atlassian Customer Agreement.

2. You can use it with any Git or Hg repos, but not SVN. Git and Hg repos can be used as far as you have access to them (they can be in the Cloud, or they can be stored locally on your computer).

3. For analytics we collect usage statistics, e.g. button clicks, and configuration statistics counts of git/hg repositories used, counts of Bitbucket/GitHub/Bitbucket Server accounts etc. It is all anonymous and the user can opt out of it. For (E-)MAU we collect anonymous installation information.

Sourcetree does not independently store any of the code from a repository, that is all managed by Git/Hg. Sourcetree does create and manage some additional meta data, held in a sourcetreeconfig file in the .git or .hg folder of a repository, but this is only ever stored on the local machine.

4. Components are listed in the Help/About dialog.

Hope that helps!

Ana