181,874 meetings wide open: how you could read other people's calls in tl;dv

tl;dv (short for “Too Long; Didn't View”) drops a bot into Google Meet, Zoom or Teams, records the conversation, transcribes it and produces an AI-generated summary. It's used by more than two million people: salespeople, HR staff, civil servants. In other words, people store there exactly the kind of content over which they nervously announce “this meeting is being recorded” at the start of a call.

What the hole was

A researcher going by the handle BobDaHacker found that the meetings collection in the Firestore database had no tenant isolation. Any authenticated user — even on the free tier — could query every single meeting on the platform. Each record handed over the creator's email, the conference ID, the provider, the recording status and timestamps. Tellingly, all the other collections (users, transcripts, videos, teams and the rest) returned 403 — meetings had simply been forgotten.

The nastiest part: the conference ID is a link you can join through. For meetings with a status of “recording in progress,” that's a live call. At any given moment there are around a thousand of those in the database. The author watched the collection in real time, grabbed an ID and joined uninvited. He did this twice: he landed in a presentation by Malaysia's Ministry of Education with 157 participants, and in a call among students at an American university who happened to be discussing that they needed client-side validation for .edu addresses (server-side wasn't even on the table).

The scale

The collection turned out to hold 181,874 meeting records belonging to 84,312 users across 35,003 domains. Among them were government meetings from 23 countries with .gov domains, calls from universities (Berkeley, the University of Tokyo and others) and corporations such as HubSpot and Confluent. Of 27,334 meetings checked, more than a thousand were public, which opened up access to videos, transcripts and the emails of the invitees.

A separate irony is the company's internal infrastructure. Its microservices are named after pasta (carbonara, fusilli, ravioli), and employees had vibe-coded a betting-pool game for the 2026 World Cup on Base44, called “Too Long; Didn't Score.” Its API handed over the whole roster of 19 employees, with names and corporate emails, with no authentication whatsoever.

Six months of silence

The saddest part is the disclosure. The author wrote in on January 28, 2026: co-founder Raphael Allstadt replied within minutes, asked him to forward the email to the CTO and promised the CTO would “be back soon.” The CTO never came back. Further reminders in January, February, March and July ran into either hearts from Raphael or silence. As of publication, six months later, the database was still open.

Meanwhile, tl;dv's security page is festooned with SOC2, GDPR and EU AI Act badges and promises a security-team response within 24 hours. As the researcher notes, the uptime on their leaky Firestore turned out to be better than that of their inbox.

Source: Lobsters