Update custom_detectors.yaml with additional exclude patterns

Add exclude regexes for bare snake_case identifiers and letters-only dotted member chains (e.g. cachedResponse.usage), reducing false positives in the Generic Secret or Token detector.

Author: ssharma12-cs

.github/custom_detectors.yaml

@@ -258,4 +258,11 @@ detectors:
       # 3. Bare lowercase dotted identifier chain (a.b.c). Lowercase-only ON PURPOSE:
       #    a case-insensitive version would also match mixed-case JWTs and silence a
       #    real leak. Does NOT catch camelCase JS member chains - exclude those by path.
-      - '^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$'
+      - '^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$'
+      # 4. Bare snake_case identifier (letters+underscores, no digits) - a symbol name,
+      #    e.g. a function being called: next_token = extract_next_token_from_meta(...)
+      - '^[a-z]+(?:_[a-z]+)+$'
+      # 5. Letters-only dotted member chain - catches camelCase JS/TS member access
+      #    (cachedResponse.usage) that rule 3 deliberately misses. Letters-only is what
+      #    keeps it safe: JWT segments and real secrets carry digits.
+      - '^[A-Za-z]+(?:\.[A-Za-z]+)+$'