tl;dv left its Firestore wide open, exposing 181,000 AI meeting recordings

Over 181,000 AI meeting recordings left wide open in note taking app

Researcher BobDaHacker found that AI meeting recorder tl;dv had no tenant isolation in its Firestore database. Any authenticated user could query all 181,874 meeting records across the platform, each exposing the creator's email, conference ID, and recording status. He used a live ID to join a 157-person Malaysian Ministry of Education call and a US student startup meeting uninvited. He reported the bug in January 2026; by July the database was still open and the CTO never responded. A separate internal World Cup prediction app also leaked 19 employee names and corporate emails via an unauthenticated API.

Why it matters: A security researcher found tl;dv exposed 181k meeting records via a Firestore misconfiguration, with live meeting hijack possible. Reported six months ago, still unfixed, CTO silent. Hits all three HKR axes: the number and scenario grab attention, the root cause is clearly ex...