feat(stock): allowed domains and IPs, lock if none provided with error message