switch to config based whitelist