the whitelist should come from config instead of hardcoding.