Tl;dv: Over 180k meetings left wide open
- ID
- 12731
- Status
- summarized
- Published
- 10 Aug 2026, 8:26 PM
- Fetched
- 12 Aug 2026, 11:11 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://bobdahacker.com/blog/tldv-hack
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.0
- Created
- 12 Aug 2026, 11:12 AM
- Tags
- Audience
- developersdatabase_learnerssaas_foundersai_agent_users
What happened
A security researcher found that tl;dv, an AI meeting recording platform with over 2 million users, has no tenant isolation in its Firestore meetings collection—any authenticated user can query all 181,874 meetings across every account, exposing joinable conference IDs for live Google Meet and Teams calls. The researcher demonstrated the flaw by walking into a live Google Meet belonging to the Malaysian Ministry of Education with 157 participants, and a US university startup call. The vulnerability was reported January 28, 2026; six months later the Firestore database remains open and the CTO never responded.
Why it matters
If you build on Firebase/Firestore or Supabase, this is a concrete reminder that authentication is not authorization—every authenticated user querying a shared database needs row-level security or tenant-scoped query rules, or you leak every record. For Malaysian builders and government agencies, the fact that a live Ministry of Education call was joinable by a stranger shows the downstream risk of adopting third-party meeting bots that store conference IDs in poorly isolated databases. Anyone currently using tl;dv should assume their meeting links and participant data are exposed and evaluate whether to continue.
Discussion angle
Walk through the exact Firestore misconfiguration: a JWT exchanged for a Firebase token with no per-user query constraints on the meetings collection—then compare it to how you'd enforce row-level security in Supabase or Firestore rules for a multi-tenant SaaS.