tl;dv: Over 180k meetings left wide open

By bobdahacker 🎄 (Currently reporting from 39C3 in Hamburg!)

---

🚩 The Premise

I first reported this security flaw on January 28th, 2026. It seems my emails were perhaps too verbose, and they simply weren't read.

tl;dv (Too Long; Didn't View) tl;dv is an AI-powered platform for recording meetings. Their service works by inserting a bot into Zoom, Google Meet, or Microsoft Teams calls to record, transcribe, and summarize the audio via AI. It's a tool heavily promoted by the "sales influencer" crowd on LinkedIn.

The platform stores highly sensitive data:

• Corporate sales pitches
• Job interviews
• Performance reviews
• Internal strategic planning

It is the exact kind of environment where participants hear "This call is being recorded," give a nervous laugh, and then proceed to spend 45 minutes disclosing trade secrets.

🔓 The Vulnerability

The security failure occurs during the authentication handshake. When a user signs up, the platform uses a JWT (JSON Web Token), which is then exchanged for a Firebase token through the following endpoint:

gw.tldv.io/v1/users/firebase/token

Once obtained, this token grants the user permission to query the Firestore database located at: projects/lmi-store/databases/(default)

The Attack Vector

Any user with a valid tl;dv account could query every single meeting across the entire platform. The meeting records revealed:

1. The creator's email address.
2. The Conference ID (the actual link to the Google Meet or Teams room).
3. The provider and recording status.
4. Timestamps.

If a meeting's status was set to recording, the Conference ID represented a live, active call. By monitoring the collection in real-time, an attacker could spot a meeting starting and simply walk into the room. At any given moment, there were roughly 1,000 active recordings available for infiltration.

Real-World Examples

I tested this by joining a live Google Meet hosted by the Malaysian Ministry of Education. In another instance, I joined a call with students from a prominent US university who were developing a startup.

They were screen-sharing their entire project and discussing prototypes. Ironically, they were talking about the need to implement client-side validation for .edu emails. They were also configuring Supabase live; I remember hoping they were setting up RLS (Row Level Security) policies, because if they didn't, they'd end up exactly like tl;dv.

📊 The Scale of the Leak

The sheer volume of exposed data was staggering. I queried the Firestore collection and found the following:

• Total Meeting Records: 181,874
• Unique Users: 84,312
• Unique Email Domains: 35,003

Using LaTeX, we can see the average number of meetings per user: $\text{Average Meetings} = \frac{181,874}{84,312} \approx 2.16 \text{ meetings/user}$

Exposed Entities

• Governments: Meetings from 23 different nations, including:
  • Americas: USA, Brazil, Colombia, Peru, El Salvador, Chile, Mexico, Haiti, Jamaica, Honduras, Argentina.
  • Asia/Pacific: Philippines, Indonesia, Malaysia, Uzbekistan, Sri Lanka, Thailand, Japan, Israel.
  • Others: Ukraine, Qatar, South Africa, Belize.
• Academia: Berkeley, University of Tokyo, De La Salle, Universidad Nacional de Colombia.
• Corporate: HubSpot, Confluent, Mekari, AnyMind Group, and Mitsui-Soko (484 meetings across four offices) and Mitsui Fudosan.

The bottom line: Every single company that utilized tl;dv had their meeting metadata stored in one unprotected, enumerable collection.

🍝 "But Wait, There's More"

Public Content Scraping

While most meetings are private by default (blocking video/transcript access), I scraped 27,334 meeting IDs to check for public settings. I found:

• A Brazilian government conservation meeting (PACTO Mata Atlântica) involving the WWF, The Nature Conservancy, Conservation International, WRI, and the São Paulo state government.
• Sessions from the Ministry of Digital Transformation in Ukraine.
• Meetings involving Chile's Cámara Verde and the Universidad Nacional de Colombia.

The "Pasta" Infrastructure

tl;dv appears to name its microservices after pasta. A subdomain scan revealed several: cappellini, carbonara, fusilli, pasta, penne, puttanesca-v0, and ravioli (all under tldv.io).

Too Long; Didn't Score

While poking around, I found https://worldcup.tldv.io, an internal "vibecoded" prediction game for the 2026 FIFA World Cup built on Base44. The internal team name was "Too Long; Didn't Score."

The API was completely open:

GET /api/entities/Player

This endpoint returned the entire employee directory without requiring a session cookie. Interestingly, Raphael Allstadt—my primary contact for disclosure who gave me vague answers before disappearing—was in 2nd place with 298 points.

📩 The Disclosure Timeline

I contacted Raphael Allstadt via LinkedIn on January 28th. The response was a series of deflections.

The Dialogue:

Me: (Reports huge vulnerability leaking user data) Raphael: "can you report it to our CTO and we will look at it immediately?" Me (Jan 29): "your cto hasnt reached out yet btw and its not fixed." Raphael (Jan 30): "I am sure the team is reviewing it very very soon ❤️" Me (Feb 14): "havent got an email and the vulnerability stilll works." Raphael: "He'll come back ☺️ I told him to maybe fix the vulnerability and not leave customers exposed. It needs some time, but rest assured we're following through."

Despite the chaos, their website has a tiny line at the bottom: "If you have discovered a privacy or security issue... please let us know at [email protected]."

🎯 Final Word to tl;dv

Your platform handles the most intimate and sensitive professional conversations. Your users trusted you with data they explicitly consented to record. You managed to implement security correctly for almost every other collection—users, chats, transcripts, clips, recordings, videos, notes, teams, and organizations—yet you left the front door to the meetings collection wide open.