Your own upstream proxy
A paid account can send its sandboxes' traffic, or only the hosts it names, through its own HTTP or HTTPS proxy, with one of its secrets as the proxy's password. Runtime's own checks still come first, and a proxy that fails refuses the connection rather than going direct. See networking.