I was struggling to find the actual whitelist. Looks like its configuration defined?