The tl;dv security incident (2026): what was exposed and how to keep a copy of your meetings
Short answer: in 2026 a security researcher reported that tl;dv's meetings database let any signed-in user list other customers' meeting records. tl;dv says it blocked the access path on August 4, 2026 and finished a permanent fix on August 5 (tl;dv incident report). The exposed data was meeting metadata: meeting IDs, the links used to join Google Meet or Teams calls, and creator and participant email addresses. tl;dv says passwords, recordings, transcripts, AI notes and billing data were not reachable, except for meetings that users had deliberately set to public (tl;dv's statement). Whatever you decide about tl;dv, it's a good moment to keep your own copy of your transcripts.
What happened, according to each side
The researcher. BobDaHacker wrote that the meetings collection had no tenant isolation, so any free-tier user could query 181,874 meetings from 84,312 users across 35,003 domains. They say they joined 2 live calls uninvited and that they first reported the issue on January 28 (researcher's post). Dark Reading reported that some exposed meeting IDs led to invitee emails and transcripts that were already public on the open internet (Dark Reading).
tl;dv. tl;dv says there were two separate attack paths: the first was fixed and validated by its penetration-testing vendor Abicom months earlier, and the second was closed within 24 hours of discovery. It says it is removing Firebase, the database involved, from its stack (tl;dv's statement). Its incident report says it found no sign of misuse by anyone other than the researcher, but that it didn't keep per-request logs for that access path, so it can't rule out other access between January 27 and August 5, 2026 (tl;dv incident report).
What was and wasn't exposed
| Data | Exposed? |
|---|---|
| Meeting IDs and conference join links (Meet, Teams) | Yes |
| Meeting creator email address | Yes |
| Meeting titles and invitee emails | Only for meetings set to public |
| Transcripts and AI notes | Only for meetings set to public (tl;dv says these were already viewable by anyone with the link) |
| Recordings, passwords, card and billing data | No, per tl;dv |
Sources: tl;dv incident report (Aug 20, 2026), tl;dv blog.
4 practical steps if you use tl;dv
- Replace recurring join links. tl;dv says it asked customers who may have been affected to reissue their meeting join URLs as a precaution (source). For standing Meet or Teams links that tl;dv recorded, generate new ones.
- Re-check public sharing. tl;dv says it switched meetings that customers had set to public back to private as a precaution (source). If you share recordings with clients via public links, those links may no longer work, so re-share deliberately.
- Ask for the details if you need them for compliance. tl;dv says a signed attestation from Abicom is available to customers at security@tldv.io (source).
- Keep your own copy of your transcripts. Whether you stay or switch tools, an offline archive means your meeting history doesn't depend on any one vendor. If you're leaving, export first and only then delete your account.
How to export every tl;dv transcript
tl;dv's transcript downloads and API access depend on your plan; API access is available on Pro, Business and Enterprise. With a few meetings you can copy each transcript by hand (see the full guide). For a whole archive, MinuteHaul uses tl;dv's official API from your browser and gives you one ZIP: a Markdown file per meeting with speakers and timestamps, a CSV index, and a combined text file for ChatGPT, Claude or NotebookLM. Your API key stays in browser memory and your transcripts go straight from tl;dv to your disk; MinuteHaul never stores them.
Buy unlimited: $29 one-time or try it free on your 10 most recent meetings
Guarantee: 14-day money-back, no questions asked.
Moving to another recorder? See how to migrate off tl;dv without losing your history.
FAQ
Were tl;dv recordings or transcripts leaked? tl;dv says recordings, transcripts and AI notes were not accessible through the flaw, except for meetings users had set to public, which were already viewable by anyone with the link. The researcher and Dark Reading reported that some exposed meeting IDs led to invitee emails and transcripts that were publicly available online.
How many tl;dv meetings were exposed? The researcher reported 181,874 meeting records from 84,312 users across 35,003 domains. tl;dv's statements describe the exposed data as meeting metadata and don't give a different count.
Is the tl;dv vulnerability fixed? tl;dv says it blocked the access path on August 4, 2026, applied permanent access controls on August 5, and is removing Firebase from its stack.
Should I delete my tl;dv account? That's your call. If you do, export your transcripts first, because deleting removes your meeting history. MinuteHaul exports every transcript to one ZIP through tl;dv's official API; the 10 most recent meetings are free.
Is MinuteHaul affiliated with tl;dv? No. It is an independent tool.
Related guides
- Bulk export tl;dv transcripts
- Back up your tl;dv meetings
- Migrate off tl;dv
- Export your tl;dv meetings before you cancel
- Switching from tl;dv to Fireflies
Last checked: Oct 18, 2026. This page summarizes public statements by tl;dv and the researcher; it isn't legal or security advice. Check tl;dv's own incident report for updates.