tl;dv left 181,874 meeting records readable by any free-tier account for six months

Researcher BobDaHacker found tl;dv's Firestore meetings collection had no tenant isolation: any authenticated free-tier account could read 181,874 records across 84,312 users, plus joinable conference IDs for the roughly 1,000 calls recording at any given moment. Every other tl;dv collection returns 403, so this is a per-collection rules gap — the kind that surfaces only when someone queries the database as a second tenant. Reported to the CTO on 28 January 2026 and chased through July, it remains unfixed.

Source: bobdahacker.com ↗