New repository auto added groups with write access
I just created a new repository from within SourceTree on my Mac. A little later I got an email from a colleague that I worked with a year ago letting me know that he'd been given write access to the repository.
It turned out he was in a group that used to have write access to another repository.
I don't think new repositories should automatically be allocated to anyone other than the creator by default.