tl;dr: AI meeting-recording platform tl;dv left its Firestore `meetings` collection without tenant isolation, allowing any authenticated free-tier user to enumerate 181,874 meetings from 84,312 users across 35,000 domains—including government, university, and corporate calls—and even grab live conference IDs to join in-progress Google Meet/Zoom sessions uninvited. The researcher also found a separate internal World Cup pick'em app leaking the employee directory via an unauthenticated API. Despite disclosure in January 2026 and repeated follow-ups, the CTO never responded and the vulnerability remains unpatched six months later.