You'd probably have to start by banning unsafe code in general, but then whitelisting/allowlisting specific versions of specific crates that are allowed to use it, so that at least the most popular dependencies don't break.