OpenAI agreed not to use Apple's alleged trade secrets as a judge considered an injunction. Both companies are now raising allegations over confidential files.

The post OpenAI Agrees Not to Use Apple Trade Secrets in Ongoing Lawsuit appeared first on TechRepublic.

OpenAI agreed not to use Apple's alleged trade secrets as a judge considered an injunction. Both companies are now raising allegations over confidential files.

The post OpenAI Agrees Not to Use Apple Trade Secrets in Ongoing Lawsuit appeared first on TechRepublic.

Freightmate AI has settled a trade secrets lawsuit filed by San Francisco-based freight forwarder Flexport on terms that will keep the Bellevue, Wash.-based logistics software startup’s products on the market.

“We’re glad to have this resolved,” said Bryan Lacaillade, Freightmate’s CEO and co-founder, in a statement. “I’m incredibly grateful to our team, customers, and partners for their support throughout this journey, and we’re excited about what’s ahead for Freightmate.”

The case raised a question that could become more common as employees leave big companies to start AI ventures: whether everyday business documents count as valuable trade secrets when they can be fed into AI models.

Lacaillade and fellow co-founder Jason Zhao, both former Flexport employees, acknowledged in a stipulated court judgment that they and the company acquired approximately 2,000 confidential Flexport shipping documents and used some portion of them. But they denied Flexport’s claim that Freightmate’s product was built on them, and the court ultimately made no finding of liability.

The documents included bills of lading, arrival notices and other paperwork from about 70 Flexport shipments. Court filings show that Lacaillade and another co-founder, Rishab Gadroo, each ran five to 10 of the documents through OpenAI’s GPT-4o model in 2024 to test how well it could pull out standard information.

Flexport argued in court filings that the use went further, saying the documents helped shape the prompts Freightmate wrote for its AI system, giving the startup a head start.

Freightmate responded in its own filings that it built its product independently, and that the documents weren’t trade secrets in the first place.

The companies notified the court of the settlement Oct. 5. The case had been set for a jury trial starting Oct. 19 in U.S. District Court in San Francisco before Judge Rita Lin.

Financial terms of the settlement weren’t disclosed. The judgment says Flexport’s claims for monetary damages were resolved in a confidential agreement, and each side will cover its own legal fees as part of the resolution. Flexport had sought a court order that could have barred Freightmate from selling its main product for a period of time.

“We’re satisfied with this result,” said Courtney Heger, Flexport’s vice president and head of marketing and communications, responding to GeekWire’s email inquiry. She said the judgment includes key admissions that were backed up by a detailed forensic review conducted during the case. That review’s findings weren’t made public.

Lacaillade and Zhao joined Flexport from Amazon in 2021 and left in 2024 to start Freightmate, which came out of stealth that June with a $650,000 pre-seed round from Wischoff Ventures. It raised a $5 million seed round led by Fuse in January 2025.

Freightmate has 17 employees, Lacaillade said in a follow-up email. The company sells AI-powered freight forwarding software, along with add-on tools that pull data from shipping documents and handle customs paperwork and invoices. Its customers include some of the world’s largest freight forwarding and logistics companies.

Flexport sued in March 2025, alleging that the founders secretly planned the startup while still at the company, as GeekWire reported at the time.

As part of the stipulated judgment, Zhao acknowledged that he acquired Flexport confidential information, including trade secrets, and both founders agreed that they knew or should have known that acquiring the shipping documents violated their agreements with Flexport.

They didn’t admit Flexport’s other allegations. Lacaillade said in an email that the stipulated facts “were agreed to as part of resolving the case” and only for purposes of the lawsuit.

He underscored that Freightmate and its founders deny liability, that nothing else in the judgment is an admission, and that it preserves Freightmate’s right to compete and to independently develop and sell its software.

Going forward, the judgment calls for a neutral forensic examiner to search Freightmate’s systems and cloud storage for Flexport documents. If any exist, the examiner will oversee their deletion, along with any product changes needed to remove Flexport data. Lacaillade said Freightmate is cooperating fully with the review, which is due to be completed by Jan. 30, 2027.

The startup’s focus, Lacaillade said, is on its customers and on building the company.

Welcome back, cyberwarriors! 

You’ve probably seen people committing their env files to GitHub without noticing it. When you’re looking for a job as a coder, that mistake alone is significant enough to get you rejected if it happens during the technical portion. And if it ever happened to you, it’s happened to plenty of others too.

Today we’ll look at TruffleHog. It’s a tool that scans Git repositories and their full history for secrets that got committed by accident. It uses high entropy checks with custom regular expressions to catch strings that look like API keys, tokens, passwords and other sensitive data. You can point it at one repository or use a GitHub or GitLab API to hit a lot of projects in one go.

A developer can delete a key from the latest commit, but it will still live in Git’s past. With those credentials, you access services without making much noise.

Installation

First install git-dumper and TruffleHog. The Python package and the GitHub release are not the same, so pay attention to which one you’re on.

kali > pip3 install git-dumper  
kali > pip3 install trufflehog

We’ll use git-dumper when we find an exposed .git directory and then run TruffleHog against that dump. Leaked .git folders are still common.

Dump a Repository

Some servers leave the entire .git directory open. Below you can see a website where it was fully accessible.

Dump it by giving git-dumper the URL and a local folder for the files.

kali > git-dumper http://example.com/.git dump

Other websites block the directory listing but still serve some of the files.

Git-dumper can pull every object, commit and reference it can reach.

kali > git-dumper http://example.com/.git/  dump

Everything will be stored in the dump folder.

Analyzing the Repositories

Once the dump is on disk, run TruffleHog against it. By default it runs entropy-based matching. That can help, but it shouldn’t be the only mode you know. In our case, regex with entropy off gave us more results. 

kali > trufflehog --regex --entropy NO dump

In one of the files we found database credentials.

You can also install TruffleHog from the GitHub release and scan the filesystem directly:

kali > curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin 

kali > trufflehog filesystem /home/kali/Documents/dump  

This build is fine for tuning your scans, but it often makes more noise and false positives, so just be aware of it.

Other Ways to Analyze Repositories

Depending on which build you’re using, try these flags to change what you get in the output.

Scan a repo for verified secrets:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown

Verified means TruffleHog checked these finding live against the service API (AWS, GitHub and so on). Unknown is both high entropy and regex hits that it couldn’t confirm.

Same scan with JSON output:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown --json

Scan a GitHub repo including issues and pull requests:

kali > trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments  

That digs into issues, comments, PR bodies and comments. You can find leaks in discussions too.

Scan a local Git repo:

kali > trufflehog git file://test_keys --results=verified,unknown  

Useful when you’ve compromised a dev Linux machine with multiple projects on it. There’s a better chance of finding something locally than pushed to GitHub, although both can happen, as you now know.

Summary

We had an external pentest where several services were accessible but no credentials could be found. Surprisingly, some developers had kept projects they were doing for the company publicly accessible on GitHub. Eventually we found a working pair and got into a database.

TruffleHog can be really helpful here. Sensitive files sometimes get exposed without the publisher even knowing it. We’re humans and we make mistakes. Offensive or defensive, the point is the same.

The post Open Source Intelligence (OSINT): Finding Leaked Secrets with TruffleHog first appeared on Hackers Arise.

Welcome back, cyberwarriors!

When you just land on a new machine, you often have to sit down and go through every running service just to figure out what’s actually installed and which of those apps might be worth a closer look for credentials in a config somewhere. You can’t skip this part, as it usually gives you something you’ll need later in the engagement, but it eats time. A lot of it.

There are older tools that try to do something similar, but the two we’re covering today are more current. LOLCreds and CredsHound come from the same developer and they cover a huge amount of software.

So let’s see how they work.

LOLCreds

LOLCreds is a website that has 678 different credentials. Some software generates a password when you install it or prompts you to enter it. There are also static credentials that are baked into the product. The D-Link backdoor credentials are a good example of the second kind. 

LOLCreds also tracks AI API keys and shows you exactly where to find them on a system. Here’s what it has on Cursor.

MySQL is a more basic example. Its password is often hidden in a config file or sitting as a variable in the env file.

CredsHound

All of that is great when you already know what software you’re hunting through and you’re picking it one at a time. But machines might have dozens of applications running. Software can be removed, but configs stay and password reuse is common. You can use CredsHound for this hunt. 

CredsHound is a scanner written in Go. Under the hood it pulls templates from LOLCreds so it can run product aware checks. It has been fully optimized for modern environments, so it will scan everything from DBeaver encrypted databases to OpenCode, GitHub Copilot CLI, Hugging Face, OpenAI and more. 

Setting Up

Before you start using the scanner, you need to have Go installed.

bash$ > sudo apt install golang
bash$ > go install github.com/haxxm0nkey/credshound/cmd/credshound@latest

Once that finishes, you may run into a common issue where the Go binaries aren’t included in your system path yet. Add them yourself:

bash$ > sudo echo “export PATH:$PATH:/home/user/go/bin” >> /etc/profile
bash$ > source /etc/profile

Now we’re ready.

How to Use

There are different ways you can run it, but you always start with updating the template library. The scanner can be used with different privileges, but we’ll use root. 

# Update templates 
bash# > credshound -ut

# Scan /etc 
bash# > credshound -t /root/.cache/credshound/templates /etc

Our system is fresh, so there’s not much on it yet. A box that’s been sitting in prod for a while will have more interesting results, like the one below.

CredsHound can also work with BloodHound to show you the relationships between credentials as a graph. Here’s how to set it up:

ubuntu$ > credshound -t ~/lolcreds-templates -bloodhound -o credshound-bloodhound.json .

Then you import the JSON file into BloodHound and see what comes up.

When you’ve collected many of these JSON files from different machines, you’ll start seeing the architecture of what you’re testing.

A few more commands you’ll find useful:

# Scan the current directory
bash$ > credshound .

# Scan multiple roots
bash$ > credshound ~/project /etc

# Scan only env variables
bash$ > credshound -sources env

# Scan current and process environment variables on Linux
bash$ > credshound -sources env,proc

Summary

Credential hunting is a tedious thing when you do it manually, but you can’t really skip this part. It’s essential to move further. The tools covered can make the whole process easier and the output rich. LOLCreds has a reference library for different products and CredsHound can scan your hosts for secrets with results that you may import into BloodHound.

If you like red teaming, we have our Red Team Operator training, where we cover more tools and techniques to help you emulate real APT work, so you can give a company a realistic stress test and help make it secure.

The post Pentesting: Stealing Credentials with LOLCreds and CredsHound first appeared on Hackers Arise.