Tenant isolation runs deep on bbstats.am:
- Public accounts are scoped per league:
(email, championship)is unique, so registering at FAS doesn't sign you into another league. - Auth tokens are double-checked against the request host — a token from one tenant pasted into another returns 403.
- Web push subscriptions belong to the origin you registered on; each subdomain or custom domain has its own push channel.
- Real-time scoring uses Pusher channels prefixed with the tenant id, so two leagues with the same team slug never see each other's events.
- Verification and reset emails link back to your league's own URL, not a shared one.
It all happens transparently — your fans just sign up, follow their team, and start getting alerts.