tl;dv left 181,874 meetings from 84,312 users queryable by any logged-in account, unfixed for six months.

Researcher bobdahacker disclosed that a missing Firestore security rule let any authenticated user query every meeting on the platform, spanning 35,003 domains including government entities in 23 countries. Records exposed creator emails, conferencing provider, timestamps, and a conference ID usable to join roughly 1,000 live Google Meet/Teams calls uninvited. Reported January 28, CTO never responded, still unpatched at the July 22 final follow-up, confirmed live by Dark Reading on August 4. This is a one-line security rule. The vulnerability isn't technical, it's organizational: nobody at tl;dv owned the inbox where this arrived.