A custom direct list: sites that must never touch the proxy

Some sites should never see a proxy: online banking and payments (foreign IPs trip risk control, sometimes freezing cards), corporate intranet systems, domestic game boosters, streaming sites (avoid detours and stutter). The fix is high-priority DIRECT rules for them.

Append via Mixin (recommended)

Editing the subscription file directly gets overwritten on the next update; the durable way is Settings → Profile Mixin, inserting rules at the front:

mixin:
  rules:
    - DOMAIN-SUFFIX,icbc.com.cn,DIRECT
    - DOMAIN-SUFFIX,alipay.com,DIRECT
    - DOMAIN-SUFFIX,company-internal.com,DIRECT
    # then re-append the original rules (syntax depends on your Mixin template — see Mixin basics)

Verifying

1. Visit the target site;
2. Search its domain on the Connections page;
3. Confirm the Chains column reads DIRECT.

The inverse approach also exists: point the MATCH catch-all at DIRECT and whitelist only the sites that need the proxy — suits light proxy users; see the discussion in "The MATCH catch-all".