The article tells app maintainers that:

> To fix and avoid RCE in your app, you need to edit Info.plist file and replace http -> https for SUFeedURL key.

So to check for vulnerable apps I just grepped for SUFeedURL in my Applications folder:

    snowwrestler$ grep -R SUFeedURL /Applications/*
    Binary file /Applications/Coda 2.app/Contents/Frameworks/Sparkle.framework/Sparkle matches
    Binary file /Applications/Coda 2.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle matches
    Binary file /Applications/Coda 2.app/Contents/Frameworks/Sparkle.framework/Versions/Current/Sparkle matches
    /Applications/Coda 2.app/Contents/Info.plist:	<key>SUFeedURL</key>

Then I looked in that Info.plist file and saw:

    <key>SUFeedURL</key>
    <string>https://www.panic.com/updates/update.php</string>

HTTPS, so I think I am good, right?

If I found HTTP strings I could protect myself by just setting them to HTTPS. Either the app would update over HTTPS (if available), or the update mechanism would just break. I'd have to manually check for updates though.