Seems like Safari has a very strong restriction on Content Security Policy (CSP).
For example, on GitHub, most of the userscripts and extensions don't work because of it.
I get errors such as this from the console:
[Error] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy. (pulls, line 0)
How do I stop CSP check in Safari?