A couple of years ago, I wrote this code that works a bit differently – it allows only a whitelist and collects all invalid nodes for error reporting:

def ensure_ast_safe(ast) do
  Macro.prewalk(
    ast,
    [],
    fn
      {fn_name, _, _} = node, acc
      when fn_name in [:%{}, :sigil_D, :=, :sigil_U, :<<>>, :{}, :<>] ->
        {node, acc}

      {atom, _} = node, acc when is_atom(atom) ->
        {node, acc}

      node, acc
      when is_atom(node) or is_binary(node) or is_integer(node) or is_list(node) or
             is_float(node) ->
        {node, acc}

      node, acc ->
        {nil, [node | acc]}
    end
  )
  |> elem(1)
  |> case do
    [] ->
      :ok

    expressions ->
      {:error, {:unsupported_expressions, expressions}}
  end
end

Hope it helps