En 30 secondes
Matthew Berman plays the roles of a rapid app builder and an IT lead in a promotional skit for Superblocks. A customer portal exposes other customers’ invoices because hiding an admin button did not enforce authorization on server-side queries. The IT lead character describes automated security scans, deployment into a company’s cloud environment, and questions about application inventories. These are promotional claims in a scripted scenario; the video does not independently demonstrate or verify the product’s security or data-location guarantees.
- 1Missing authorizationThe IT lead asks whether every server-side query enforces authorization; the builder has only hidden an admin button.
- 2Cross-customer exposureIn the fictional example, changing an ID in the URL reveals another customer’s invoices.
- 3Promised security workflowThe skit claims that security agents scan, propose fixes, and rescan before deployment; the video does not demonstrate the process.
- 4Hosting and inventory claimsThe IT lead character describes deployment in the organization’s cloud and using Claude to ask about applications touching customer data.
- 5Governance pitchThe closing promotion frames Superblocks as a way to combine employee-built apps with IT and security controls.
À retenir
- Hiding a button in a user interface does not enforce server-side authorization.
- Changing a resource identifier can expose another customer’s records if the server does not check access rights.
- The skit presents Superblocks as a way to let employees build applications while IT controls what they can access.
- Claims that automated scans would prevent the illustrated flaw and keep data inside a network are not independently tested in the video.
Lire le texte remanié, chapitre par chapitre
A customer portal with a security flaw
A builder announces a new portal, but the fictional IT lead identifies a missing authorization check. Customer invoice data becomes visible across accounts.
In a short promotional skit, Matthew Berman plays a rapid app builder who proudly announces a customer portal shipped in a morning. The IT lead character asks whether authorization is enforced for every server-side query. The builder replies that the admin button was hidden, treating that as equivalent.
The fictional portal then exposes one customer’s invoices to another. The IT lead explains that hiding a button is not authorization: if a server accepts a different ID without checking access, someone can retrieve data belonging to another customer. This is a scripted illustration of a server-side access-control failure, not an identified real incident.
The Superblocks pitch
The IT lead character describes security scans, deployment, and app-inventory capabilities. These product claims are presented without an independent demonstration.
The IT lead introduces Superblocks, saying employees can build applications while the organization decides which resources they can access. The dialogue frames the product as a way to support rapid development without leaving access decisions entirely to individual builders.
Asked whether it could have prevented the problem, the IT lead claims that security agents scan an app at publication, send a fix to a build agent, and scan again before deployment. That is the skit’s product pitch; it does not show a scan, a fix, or independent evidence that the illustrated vulnerability would always be caught.
The IT lead says the existing app’s data sits on vendor servers, and claims that a Superblocks deployment runs in the organization’s own cloud account and VPC without data leaving its network. The character also says Claude could answer questions about how many apps exist and which access customer data. These are claims in the promotion, not verified guarantees for every configuration.
Building with IT oversight
Berman pitches the product as an option between blocking employee-built apps and allowing them without oversight. He directs viewers to the product link.
Berman closes by presenting Superblocks as a third option for CTOs and CISOs: let people continue building while IT and security determine what their apps can access. He directs viewers to the product link.
Sur la même chaîne
34:21EN
Matthew Berman· 27 oct. 2026Matthew Berman Examines Anthropic’s IPO Filing, AI Growth and GovernanceMatthew Berman, Sam Altman · Forward FutureThe presenter reviews the S-1’s financial metrics, compute strategy and voting structure while questioning the tension between rapid AI development and safety.
0:36ENMatthew Berman· 25 oct. 2026Kimi K3.1 and a Rubik’s Cube Solver DemonstrationMatthew Berman · Forward FutureMatthew Berman shows a scrambled virtual cube being solved and gives the Kimi K3.1 test a favorable assessment.
25:50ENMatthew Berman· 24 oct. 2026Kimi K3.1 Pro Tested: Strong 3D Demos, Uneven Results and Competitive PricingMatthew Berman · Forward FutureMatthew Berman tests the open-weight model on coding, 3D rendering and visual explanations, then compares benchmark results and prices.
32:20ENMatthew Berman· 23 oct. 2026Who Is Local AI For? The Costs, Trade-offs and a Hybrid FutureMatthew Berman · Forward FutureMatthew Berman weighs data control and independence against hardware cost, setup complexity and inference speed.
1:03:37ENMatthew Berman· 23 oct. 2026Matthew Berman’s Team Tests Kimi K3.1 on Animation, Games, and ChartsMatthew Berman, Alex, Brian · Forward FutureA live team AMA turns into an informal test of Kimi K3.1, from personal-agent workflows to motion graphics, a browser game, and a benchmark chart.
0:53ENMatthew Berman· 22 oct. 2026Sam Altman on AI and the Discovery of New KnowledgeSam Altman · OpenAIAltman expects progress in mathematical discovery to extend to biology, materials and energy.