restricting permission set "Security" has not effect

[eferalgan234]

Hi, I've followed the installation instruction, and unfortunately, settings allow the user to see all Account records despite Security permission. The application runs overall OK, as you demoed it in the ApexHours video lesson https://www.youtube.com/watch?v=RMTA06yWNms but the permission set NOT restricts the user from creating and viewing all accounts. After the creation of a scratch org, the UserUser is a System Administrator with assigned permission set "Security", which has no rights on the Account object, nor read nor edit. But still, he is able to create and view all Accounts, and it makes all security methods (CRUD, FLS, Security Enforced, etc) applications useless.
My intention was to follow your presentation with my own instance of an Org. Thanks for creating those learning materials, they are great!