A malicious employee can simply send the code to the competitor. There is no need to set up an account that is controlled by the competitor to evade access protections.
How though? Can someone explain a situation where a GH organisation automatically gets access to another organisations' repos through a shared individual member?
