This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
NEXO Privilege Gate v0.4.0 is an open-source least-privilege gateway for AI agents. It now enforces structured filesystem actions inside a local sandbox, blocks path escapes and sensitive-file aliases, requires human approval for destructive actions, quarantines deletions, and records a tamper-evident audit trail. GPT-6 Astra also found and helped fix a real path-alias authorization bypass before release.
I built NEXO Privilege Gate around a simple question: if an AI agent can request an action on your computer, should that automatically mean it has permission to execute it?
v0.4.0 moves NEXO beyond a browser policy demo into real local filesystem enforcement inside an isolated sandbox.
The current build supports ALLOW, REVIEW, and DENY decisions, explicit human approval for destructive actions, quarantine instead of permanent deletion, path-traversal protection, sensitive-file protection, and a tamper-evident audit chain.
During the final pre-release review, GPT-6 Astra found a real authorization bypass: alternate path representations such as `.env/.` and Windows-specific `.env.` could cause policy evaluation and filesystem resolution to disagree about the same protected target.
Astra helped implement a canonical-path fix and added eight HTTP regression tests. The complete suite now passes 34/34 tests.
The scope is still intentionally narrow: NEXO currently protects filesystem operations inside its sandbox, not arbitrary Windows, browser, network, financial, or MCP actions.
The long-term goal is a reusable authorization layer between increasingly capable AI agents and the systems they operate.
Feedback on the threat model, policy design, and the next tool domains to protect is very welcome.
No comment highlights available yet. Please check back later!
About NEXO Privilege Gate on Product Hunt
“A least-privilege security gateway for AI agents”
NEXO Privilege Gate was submitted on Product Hunt and earned 0 upvotes and 1 comments, placing #9 on the daily leaderboard. NEXO Privilege Gate v0.4.0 is an open-source least-privilege gateway for AI agents. It now enforces structured filesystem actions inside a local sandbox, blocks path escapes and sensitive-file aliases, requires human approval for destructive actions, quarantines deletions, and records a tamper-evident audit trail. GPT-6 Astra also found and helped fix a real path-alias authorization bypass before release.
NEXO Privilege Gate was featured in Open Source (68.9k followers), Developer Tools (519.8k followers), Artificial Intelligence (479.1k followers), GitHub (41.4k followers) and OpenAI Day (39 followers) on Product Hunt. Together, these topics include over 253.9k products, making this a competitive space to launch in.
Who hunted NEXO Privilege Gate?
NEXO Privilege Gate was hunted by Santiago Alberto Patiño Sánchez. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how NEXO Privilege Gate stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Santiago Alberto Patiño Sánchez
I built NEXO Privilege Gate around a simple question: if an AI agent can request an action on your computer, should that automatically mean it has permission to execute it?
v0.4.0 moves NEXO beyond a browser policy demo into real local filesystem enforcement inside an isolated sandbox.
The current build supports ALLOW, REVIEW, and DENY decisions, explicit human approval for destructive actions, quarantine instead of permanent deletion, path-traversal protection, sensitive-file protection, and a tamper-evident audit chain.
During the final pre-release review, GPT-6 Astra found a real authorization bypass: alternate path representations such as `.env/.` and Windows-specific `.env.` could cause policy evaluation and filesystem resolution to disagree about the same protected target.
Astra helped implement a canonical-path fix and added eight HTTP regression tests. The complete suite now passes 34/34 tests.
The scope is still intentionally narrow: NEXO currently protects filesystem operations inside its sandbox, not arbitrary Windows, browser, network, financial, or MCP actions.
The long-term goal is a reusable authorization layer between increasingly capable AI agents and the systems they operate.
Feedback on the threat model, policy design, and the next tool domains to protect is very welcome.