FIX: better whitelisting