What We Shipped Overnight: MyZubster Metaverse Safety and a Live Space Station
Last night was an important step for MyZubster: we strengthened the foundations of our Metaverse and connected the Space Station to the public platform.
These are not speculative mockups. Both projects now have working public entry points, live APIs and clearly documented security boundaries.
Neon Plaza: from prototype to a safer shared world
The MyZubster Metaverse is available at:
👉 https://www.myzubster.com/metaverse
Neon Plaza currently provides:
- MongoDB-backed shared presence
- Keyboard and touch movement
- Public chat
- Proximity awareness
- Emotes
- Guest and account-linked characters
- Portals to Marketplace, LIFE, Identity, Visual and Zorgax
- A session dashboard showing online users and activity
- Browser capability diagnostics
The public API currently uses shared polling. WebSockets, WebXR, spatial voice and full 3D rendering remain future work.
A privacy and abuse-control baseline
During the night, we merged PR #920, establishing the first official privacy, retention and abuse-control baseline for Neon Plaza.
The documented production boundaries include:
- Active presence expires after 90 seconds of inactivity
- Public chat messages expire after one hour
- Inputs are sanitized and length-limited
- Operational logs exclude chat content, tokens, request bodies and session identifiers
- Account-linked identities are resolved through authenticated MyZubster accounts
- Client-provided identity claims are never treated as verified
- Permanent movement history is not collected
The pull request passed:
- CI, tests and lint
- Security Audit
- Continuous Evidence Gate
- Vercel deployment checks
We also documented what is not implemented yet: distributed rate limiting, mute, block, reporting, moderator auditing and formal deletion workflows.
Being explicit about these gaps matters. Open source development should describe the system that exists—not the system we hope to have later.
The Space Station is online
We also merged PR #921, adding a public Space Station dashboard:
🚀 https://www.myzubster.com/space-station
The integration introduces same-origin proxy routes under /api/space-station/*, allowing the website to display live station health, robot and mission information without exposing backend credentials.
The production health endpoint reports:
{
"station": "MYZUBSTER-SPACE-STATION",
"status": "online",
"version": "0.2.0"
}
The browser currently receives read-only information. Mutating inventory, economy or robot operations have deliberately not been exposed because those actions still require a production-grade authentication and authorization layer.
A broader read-only client—covering spaces, inventory, MYZ balances and missions—is being developed in PR #919.
Two environments, one ecosystem
The direction is becoming clearer:
- Neon Plaza provides the social and immersive layer
- Space Station provides robotics, missions and operational data
- MyZubster identity connects participants to persistent characters
- Marketplace and LIFE projects provide real destinations and activities
- Evidence gates keep technical claims independently verifiable
The next challenge is not adding visual complexity for its own sake. It is connecting these components safely: authenticated missions, verified contributions, controlled robot operations and immersive representations of real data.
That is how MyZubster is evolving—from a collection of experiments into an open, connected and evidence-driven ecosystem.
Repository: https://github.com/MyZubster-Ecosystem/myzubster
Metaverse: https://www.myzubster.com/metaverse
Space Station: https://www.myzubster.com/space-station
Top comments (0)