Good catch. Currently we only support constant propagation for literals. Here's a working example: $ semgrep -e "not_exec('somestr)" will match foo =

Good catch. Currently we only support constant propagation for literals. Here's a working example: $ semgrep -e "not_exec('somestr)" will match foo = "somestr" not_exec(foo) Here's a more complete example: https://semgrep.dev/s/ievans:const-python https://semgrep.dev/s/ievans:const-python In your example, we don't propagate exec because it's not seen as a literal -- that's a TODO for sure. See https://github.com/returntocorp/semgrep/issues/1645 https://github.com/returntocorp/semgrep/issues/1645 for a longer discussion!