Glonce

tl;dv exposed 181,874 meeting recordings for six months

securityThe Glonce editorsHacker News🔥87Glonce rating87Impact85Novelty70Relevance95Surprise75Players55Credibility85
tl;dv exposed 181,874 meeting recordings for six months

tl;dv is an AI meeting recording platform, used by over 2 million people, that joins Google Meet, Zoom and Teams calls with a bot, records them, and generates transcripts and summaries. A security researcher who publishes as bobdahacker found that tl;dv's Firestore database, reached after a user's login JWT is exchanged for a Firebase token at gw.tldv.io/v1/users/firebase/token, had no tenant isolation on its meetings collection. Any authenticated tl;dv user, including a free-tier signup, could query every meeting record on the platform, not just their own. Each record exposed the creator's email address, a joinable conference ID for Google Meet or Teams, the provider, the recording status, and timestamps. For meetings currently in recording status, that conference ID led to a live call in progress; the researcher counted roughly 1,000 such live meetings sitting in the collection at any given time and noted that a bot could join all of them at once.

Querying the collection turned up 181,874 meeting records belonging to 84,312 unique users across 35,003 email domains. Government meetings from 23 countries were included, all on .gov domains, among them Brazil, Colombia, Ukraine, the Philippines, Malaysia, the United States, Qatar, Uzbekistan and Japan. University meetings came from Berkeley, the University of Tokyo, De La Salle and Universidad Nacional de Colombia, among others. The remaining roughly 35,000 domains covered corporate meetings, including Mitsui-Soko (484 meetings across four regional offices), Mitsui Fudosan, HubSpot, Confluent, Mekari and AnyMind Group. The peak month was July 2025 with 43,209 meetings recorded, and the busiest weekly slot was Wednesday at 2pm UTC with 7,804 meetings.

To demonstrate the flaw, the researcher grabbed a live conference ID from Firestore and joined a Google Meet belonging to the Malaysian Ministry of Education, where a presenter was addressing over 157 participants; the tl;dv recording bot was already in the room, and now so was he, uninvited. He also joined a call where a US university team was building a startup app in front of 21 people, screen-sharing a Supabase setup while discussing email validation. He then scraped 27,334 meeting IDs to check which were set to public rather than private, and found over 1,000 were, exposing 715 invitee emails across 228 domains. Public meetings included a Brazilian government conservation session with participants from WWF, The Nature Conservancy and Conservation International, calls from Ukraine's Ministry of Digital Transformation, a HubSpot sales call, and sessions tied to Universidad Nacional de Colombia and Chile's Cámara Verde.

While mapping tl;dv's subdomains, the researcher also found an internal FIFA World Cup 2026 prediction game called "World Cup Pick'em," built for tl;dv staff on the Base44 platform. Its Player entity API required no authentication at all: a plain GET request returned all 43 player records, including 19 tl;dv employees' full names and corporate email addresses. Raphael Allstadt, the employee who had served as the researcher's disclosure contact, appeared in the data in 2nd place with 298 points, his personal Gmail address included.

The disclosure itself stretched over six months. The researcher first messaged Allstadt on January 28, 2026; Allstadt replied within minutes asking him to email the CTO, promising the CTO would follow up. Over the following months the researcher repeatedly asked for status updates, on January 29, February 14 and March 6, each time told the CTO would respond soon. tl;dv's own security page lists SOC2, GDPR, EU AI Act and other compliance badges alongside a promise that its security team responds to reports within 24 hours. As of the researcher's last message on July 22, 2026, the vulnerability was still unfixed and the CTO had never personally responded.

Key facts

  • tl;dv's Firestore "meetings" collection had no tenant isolation, letting any authenticated user query 181,874 meeting records belonging to 84,312 users across 35,003 email domains.
  • Government meetings from 23 countries were exposed, including Malaysia's Ministry of Education, whose live Google Meet with over 157 participants the researcher joined uninvited using a conference ID pulled straight from Firestore.
  • Of 27,334 meeting IDs the researcher scraped, over 1,000 turned out to be public, exposing 715 invitee emails across 228 domains, including sessions from Ukraine's Ministry of Digital Transformation and a Brazilian government conservation meeting.
  • The researcher first reported the flaw to tl;dv contact Raphael Allstadt on January 28, 2026; by his last follow-up on July 22, 2026, the company's CTO still had not responded and the vulnerability remained unfixed.
  • A separate, unauthenticated API on tl;dv's internal "World Cup Pick'em" app exposed all 43 players, including 19 employees' full names and corporate email addresses.

Why it matters

tl;dv records the kind of calls people assume are private once the meeting ends: sales negotiations, job interviews, performance reviews, government briefings, internal strategy sessions. A missing access check on one Firestore collection turned that assumption into metadata anyone with a free tl;dv account could browse, and, for live calls, a room anyone could walk into. tl;dv had gotten tenant isolation right on every other collection in its database, users, chats, transcripts, clips, recordings, videos, notes, teams, organizations all correctly returned a 403 to an unauthorized query. Only meetings was left open, and it stayed open for six months after a named researcher reported it directly to the company.

Who it affects

Every organization that has ever used tl;dv had meeting metadata sitting in the exposed collection: 84,312 users across 35,003 email domains. That includes government agencies in 23 countries (Brazil, Colombia, Peru, Ukraine, El Salvador, the Philippines, Chile, Indonesia, Mexico, the United States, Qatar, Malaysia, Uzbekistan, Sri Lanka, Haiti, South Africa, Jamaica, Honduras, Argentina, Thailand, Japan, Israel and Belize), universities including Berkeley, the University of Tokyo, De La Salle and Universidad Nacional de Colombia, and corporations such as Mitsui-Soko, Mitsui Fudosan, HubSpot, Confluent, Mekari and AnyMind Group. For the smaller set of meetings left set to public rather than private, exposure went beyond metadata to 715 actual invitee email addresses.

How to use it

The exploit chain the researcher described needed no special access: sign up for a free tl;dv account, let the platform's normal login exchange a JWT for a Firebase token at gw.tldv.io/v1/users/firebase/token, then use that token to query the Firestore path projects/lmi-store/databases/(default) directly. Every meeting record returned the creator's email, a joinable Google Meet or Teams conference ID, the provider, the recording status and timestamps, with no filtering to the querying account's own meetings. Watching the collection for records with status "recording" surfaced live calls in progress, roughly 1,000 at any given time, whose conference IDs could be joined immediately; the researcher noted that a bot could join all of them at once. Separately, tl;dv's internal World Cup Pick'em app needed no exploit at all: a bare GET request to its Player entity API returned every player record.

How solid is it

The account is a first-hand technical writeup by an independent security researcher who demonstrated the flaw directly, joining two live meetings and enumerating the Firestore collection to produce the specific counts cited (181,874 records, 84,312 users, 35,003 domains, and so on). The six-month disclosure timeline is backed by dated message excerpts with named contact Raphael Allstadt, including his direct replies. The source contains no independent confirmation from tl;dv, no statement from the company responding to the specific figures, and no verification from a third party; the numbers and the disclosure history rest entirely on the researcher's own account.

Risks and caveats

As of the researcher's last contact on July 22, 2026, the vulnerability was still unfixed and the CTO had never personally responded, per his account; the source does not say whether tl;dv fixed it after that date. The bulk of the exposure was metadata (creator email, conference ID, provider, status, timestamps) across all 181,874 records; full content exposure was narrower, limited to the meetings the researcher found set to public and the two live calls he personally joined. tl;dv's other Firestore collections reportedly returned 403 to unauthorized queries, so the flaw's scope, as described, was specific to the meetings collection, though that scope comes from the researcher's own testing rather than from tl;dv.

“still not fixed...”

— the researcher, in a July 22, 2026 follow-up message to tl;dv, after receiving no reply