It can be set either: 1. In the product.json (normally the product.json is embedded during the build and not read at run-time). 2. With the --link-protection-trusted-domains flag.
