AI Notetaker tl;dv Left 181,874 Meetings From 84,312 Users Queryable by Any Logged-In Account — Unfixed for Six Months
bobdahacker / Hacker News·high signal
Researcher bobdahacker disclosed that a missing Firestore security rule let any authenticated tl;dv user query every meeting on the platform: 181,874 records across 84,312 users and 35,003 domains, including government entities in 23 countries, universities, and corporations, peaking at 43,209 meetings in July 2025. Records exposed creator emails, conferencing provider, timestamps, and a conference ID usable to join roughly 1,000 live Google Meet/Teams calls uninvited. Reported January 28, 2026 with the CTO never responding, it was still unpatched at the July 22 final follow-up — Dark Reading confirmed the exposure was live as of August 4, and the post hit 587 points on HN.