One developer answers these.
Write to kenneth@matsuokengo.com.
A site that gets past the guard is more useful as a report: the Report button in the extension opens a prefilled issue with the details already filled in.
Open the app once, then look under Safari Settings, Extensions on Mac, or Settings, Apps, Safari, Extensions on iPhone and iPad.
It fills the first time a page tries something. A quiet list means nothing has been caught yet.
Open the extension button, find the host, and choose Use Default. That removes the rule.
The list there is read only, because iOS gives an app no way to send changes to its own extension. Changes are made in the extension button in Safari.
The host appears in the list. Allow it on that site, or everywhere.