I started looking because there were little things - he would not use his camera on zoom when the rest of the company does, he would only screenshare one tab at a time, he would not put us on his LinkedIn profile.

I looked around and noticed 3x more commits to private repos daily from his GitHub than commits to our company.

After confronting him he said people from his past companies must have been using his GitHub account. (Are you kidding me)

I asked him to solve it then and there by screenshotting and showing me what the private commits are. The screenshot had commits to two other companies.