Independent researcher BobDaHacker found that tl;dv, an AI meeting-summary service, did not restrict data access properly. Any logged-in user could obtain a token and query the database, reaching other customers' recordings, including live meetings. He reported it to tl;dv on 28 January with no response, and the flaw was still open when he published. If your team records client calls with tl;dv or similar tools, check who has accounts, remove unused ones, and ask the vendor in writing whether they have fixed the issue. Consider telling clients whose calls were recorded if you handle sensitive information.