Seems like Safari has a very strong restriction on CSP. For example, on GitHub, most of the userscripts and extension doesn't work because of that.
I got a such error from the console.
[Error] Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy. (pulls, line 0)
How can I stop CSP check in Safari?