tl;dv flaw exposed 181,874 meeting records and live-call IDs, researcher says

Why it matters

AI meeting assistants are becoming repositories for corporate memory. A single tenant-isolation error can expose live-call details across thousands of organizations.

Raphael Allstadt (@rallstadt), Allan Bettarel and Carlo Thissen are confronting a security failure at tl;dv that allegedly allowed any authenticated user to query meeting records from other customers and obtain IDs for live calls. Application-security researcher BobDaHacker counted 181,874 records tied to 84,312 users and published the findings in an August 4th disclosure.

The episode cuts directly against the operating story Allstadt has told about tl;dv. He founded the German AI meeting company with two longtime friends, brought it within one day of running out of money during its first year, and eventually turned it into a product that now claims more than 2 million users. In a 2024 account of the early years, Allstadt described the swings between investor attention, flat revenue and the pressure of learning how to hire. Scale has now handed the founders a more consequential test: whether tl;dv's security practices kept pace with the volume and sensitivity of the conversations entrusted to it.

One collection crossed customer boundaries

BobDaHacker said tl;dv exchanged a user's authentication token for a Firebase token through gw.tldv.io/v1/users/firebase/token. The token allegedly permitted queries against a shared Cloud Firestore database where the meetings collection lacked tenant isolation.

The researcher said the exposed records included the meeting creator's email address, conference provider, recording status, timestamps and conference ID. A conference ID for a meeting marked recording could correspond to an active Google Meet or Microsoft Teams call. BobDaHacker estimated that roughly 1,000 records carried that status at a given time.

Google's Firestore security guidance specifically warns against rules that give every authenticated user access to a database. Its documentation recommends user-based or role-based rules that check ownership and permissions for each request.

BobDaHacker said they used conference IDs obtained from Firestore to enter two calls: a Malaysian Ministry of Education meeting with more than 157 participants and a meeting where 21 students from a US university were working on a startup. Dark Reading independently reported on August 4th that the flaw remained active at publication and that the researcher was admitted to private meetings roughly 80% of the time when impersonating an AI notetaker.

That distinction matters. Possession of a conference ID does not automatically defeat a meeting platform's waiting room or admission controls. The tl;dv exposure allegedly made calls discoverable, while weak host controls and the routine presence of meeting bots provided the route inside.

The 181,874 figure describes metadata, not 181,874 open recordings

The headline number requires a narrower reading than the original post's title suggests. BobDaHacker reported access to 181,874 meeting records across 35,003 email domains. The researcher said recordings, transcripts, clips, notes and other collections returned authorization errors, and that meeting content was private by default.

BobDaHacker separately tested 27,334 meeting IDs and reported finding more than 1,000 publicly accessible records, including 715 invitee email addresses across 228 domains. Dark Reading later quoted the researcher describing a sample of roughly 70,000 meetings. The available reports do not reconcile those sample sizes. Neither figure supports a claim that the audio, video or transcripts for all 181,874 meetings were openly accessible.

The exposed metadata still carried operational value. The sample allegedly covered government domains from 23 countries, universities including Berkeley and the University of Tokyo, and companies such as HubSpot, Confluent, Mitsui Fudosan and AnyMind Group. Meeting timing, employee addresses and live conference IDs can reveal who is speaking, when a call is happening and how an outsider might approach it.

BobDaHacker dated the initial disclosure to January 28th, 2026. The researcher documented follow-ups through July 22nd and said the Firestore access remained available at that point. The vulnerability was therefore at least six months old when the public report appeared, rather than a flaw first discovered in August.

Security claims meet the founders' operating reality

The timing is difficult for a product built around recording conversations that users may treat as confidential. tl;dv's current security page says the service is SOC 2 Type II and GDPR compliant, encrypts stored data with AES-256, scans production systems for vulnerabilities and reviews code before deployment. The same page promises that tl;dv's security team will respond to vulnerability reports within 24 hours.

BobDaHacker's disclosure describes a basic authorization error in one Firestore collection and a reporting process that stretched from January into July. The account has been corroborated in part by Dark Reading, including the ability to retrieve other customers' meeting data and enter calls. tl;dv has not supplied a public technical account establishing the full scope, the date of remediation or whether affected customers were notified.

Allstadt's growth strategy has centered on making recorded conversations useful beyond the original call. tl;dv now markets AI summaries, follow-up emails, CRM updates, sales scoring and aggregated insights across meetings. Each additional workflow increases the amount of workplace information concentrated behind tl;dv's access controls.

The founders have already navigated a difficult shift in the product. When tl;dv announced its EUR4.3 million seed round in June 2022, Allstadt positioned it primarily as a cross-platform way to record, clip and review calls asynchronously. K Fund led the financing, with Seedcamp, Mustard Seed Maze, another.vc and Shilling VC participating. The product has since expanded into an AI system that extracts and distributes knowledge from conversations.

That expansion raises the cost of an authorization mistake. Meeting assistants are moving from disposable transcription tools into searchable corporate memory, where records can expose hiring decisions, customer negotiations, product plans and internal disputes. tl;dv's founders built their distribution around lowering the friction of recording and sharing. Their next operating challenge is proving that access to those records is constrained with equal care.