Over 181,000 AI meeting recordings left wide open in note taking app

Over the course of six months, over 181,000 AI meeting recordings have remained accessible without restriction within the tl;dv note taking app. This issue persists despite multiple attempts to report the vulnerability to the company's CTO. tl;dv, an AI meeting recording platform, allows users to join calls on Google Meet, Zoom, or Teams, which records and transcribes the conversation.

The platform stores sensitive content like sales calls, interviews, and internal strategy sessions, including government meetings from various countries. The Firestore database, which stores meeting records, does not have tenant isolation, allowing any authenticated user to access every meeting across all accounts. This means that an attacker could potentially join live calls, including those belonging to sensitive entities such as the Malaysian Ministry of Education and universities in the United States.

Additionally, over 1,000 meetings were found to be public, exposing invitee emails and potentially sensitive content. The company's internal fun app, built on Base44, also leaked employee directories, further highlighting the lack of proper security measures. Despite numerous attempts to contact the company, no response or resolution has been provided.