We believe he's given others control of his Github and other account logins. It does seem like he's taking precautions with a VPN.
How would you go about exposing this? Ideally in a brilliant and clever way.
At some point, getting your manager and/or their manager involved will be inevitable, and this is exactly the sort of problem that managers and HR exist to deal with. (assuming you're not their manager yourself).
> How would you go about exposing this? Ideally in a brilliant and clever way.
I wouldn't. If it causes problems, let your employer address them.
Ask for detailed estimates and breakdown on a problem they never heard before, and insist on an initial approach to the solutoin, then verify with what is delivered.
When you do either of these, make sure there are experienced technical people asking questions. Anyone who is technical will not mind explaining code or solutions on the spot. At the very least there should be open conversations on approach, and usually you won't be able to hold that conversation if you are not doing the job.
Non-native english speaking grammar and mistakes in Github comments. There are certain types of mistakes native English speakers make -- I make -- and the type non-native English speakers make. These are of the latter class.
His code has different styles project to project.
Logins to 3rd party tools through a VPN at every hour of the night and day -- the preempted warning that this might happen from him.
His tendency to take specific questions about his code and answer them with generalities, or more often having to think about the answer and get back to us later.
What I'm missing is hard forensic evidence.
- Consider how you'd like to be treated; like for real. What if it was you?
- Burning bridges over something like this isn't worth it. Burning bridges over anything, is almost always a bad idea. Seek to mend.
Misrepresenting someone else's work as your own is morally wrong at best.
(Edit - one interpretation of your post is this person is compromising your corporate security in some way. If this is the case, you should probably, and without trying to be clever about it, discuss your concern with the person and if not satisfied with whoever is responsible for security in your company)