Only use whitelisting for save - and add tests to proof the core deficiency here.