Prioritize privacy or security?

[unixfox]

@dalf pushed a commit dalf@37beff9 that fixed the issue #8 but while reviewing the commit I found out that currently searx-stats2 display at a higher priority an instance that have a better Content Security Policy than an instance that doesn't contain any modified scripts (like tracking or ads) so more privacy friendly than an instance with modified scripts.

What should be better for the visitors: prioritize by default the privacy or the security?

Personally I think if #11 gets merged, privacy should be the priority because there are already good mechanisms in modern browsers to secure connections between a client and a server.
Whereas it's more common to have shady scripts built in a Searx instance than having external attackers trying to gather searches from visitors of an instance by injecting scripts into the HTML page.