Security
Sign-in
Passwords and session tokens are stored as hashes. Email codes are stored as hashes and expire.
Private sites
A site that is not public is served only to the people on it. Everyone else gets a page saying it is not public yet.
Domains
A custom domain is connected after the records you add check out. Until then it stays pending.
Your account
If a sign-in looks wrong, change the password. The email on the account is how Riverrun knows the request is yours.