pii-leak-benchmark 0.5.3

pii-leak-benchmark 0.5.3 corrects one sentence in the needle registry and makes the secret fixtures safe to scan.

pip install --upgrade pii-leak-benchmark

Fixes

The Slack fixture's record is accurate again

Before: the registry said the SLACKBOT fixture "was never presented to any Slack endpoint". On 2026-10-05 the detect-secrets command-line scanner, run over the registry without --no-verify, posted that value once to Slack's token check (Slack answered that it is not valid). The sentence was no longer true.
After: the fixture's non-live basis records that single presentation, the date, the tool and the flag that prevents it. The value is unchanged and is still not a credential.

Scanning the registry cannot reach a verifier

Before: a default detect-secrets scan of needle_registry.py reported the four secret fixtures and verified the Slack-shaped one over the network.
After: every line that spells out or quotes a fixture value carries # pragma: allowlist secret, which detect-secrets honours before any verification runs; a default scan of the file now reports nothing. A new test, tests/conformance/test_needle_registry_scanner_safety.py, fails if a fixture line loses the pragma or, in CI where detect-secrets 1.5.0 is now installed, if a scan with the scanner's default filters reports anything. The registry docstring states the rule as this harness never presenting a fixture, and names both controls.

Scanner note for the Slack fixture

The fixture's notes now say that gitleaks and trufflehog never report it by design (their Slack rules want two 10-to-13-digit fields; trufflehog treats EXAMPLE and 00000 as known false positives), so a scanner result of "nothing found" on this fixture is not a split result.

No measured value, profile, oracle or inspector digest changed. Reports from 0.5.2 stay comparable.