Onebox only allows blacklisting of domains. The way I disabled Typeform (temporarily) was such that I disabled custom Typeform iframe embedding so that we can at least get the OpenGraph onebox. It’s not possible right now to whitelist Typeform iframe for certain sites.
If we want to do that we’ll have to run a migration for all Discourse instances where we’ll blacklist
typeform.com domain (by adding it into
onebox domains blacklist setting) and the site admin will then have to remove the
typeform.com domain from blacklist setting. Before doing this I want to contact Typeform and explain the issue so that they have a chance to fix this.
I just notified them via Twitter and and their custom Contact us form. I’ll follow up again next week.