tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
https://bobdahacker.com/blog/tldv-hack
Published: August 4, 2026 12:12
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://bobdahacker.com/blog/click-to-pray
Published: July 24, 2026 12:36
How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later. Nobody has ever…