AI notetaker tl;dv left 181,874 meeting recordings open to any logged-in user for 188 days
Security researcher bobdahacker found that tl;dv, an AI meeting notetaker for Zoom, Google Meet and Microsoft Teams, had no tenant isolation in its Firestore database, letting any authenticated user query 181,874 meeting recordings from 84,312 users across 35,003 domains, including government agencies in 23 countries. About 1,000 meetings were still live and joinable during testing. The flaw was reported on January 28, 2026 and acknowledged by tl;dv, but it was still open when the researcher went public on August 4, 2026, 188 days later.