SEC0108 warning false reporting

[AdamRiddick]

SEC0108 is regarding SQL injection when using string concatenation. However, the analyzer is false reporting when a constant value is passed into the procedure;

private const string ProcedureName = "MyProcedureName";

public Task ExecuteProcedureAsync()
{
    return this.Context.Database.ExecuteSqlCommandAsync(ProcedureName);
}

Note that using the procedure name instead of the constant does not report a warning.