chore: update version references to 0.11.0 in documentation

PUBLISHING.md

@@ -46,8 +46,8 @@ npm publish --access public
 6. After npm confirms the publication, create and push an annotated tag matching the package version exactly:
 
 ```bash
-git tag -a v0.9.0 -m "secureai-scan v0.9.0"
-git push origin v0.9.0
+git tag -a v0.11.0 -m "secureai-scan v0.11.0"
+git push origin v0.11.0
 ```
 
 Pushing the tag creates no npm publication job. Keep the tag and manifest version identical so the GitHub release and npm artifact remain traceable.
@@ -57,9 +57,9 @@ Pushing the tag creates no npm publication job. Keep the tag and manifest versio
 After `npm publish` succeeds:
 
 ```bash
-npm view secureai-scan@0.9.0 version dependencies dist.integrity
-npx --yes secureai-scan@0.9.0 --version
-npx --yes secureai-scan@0.9.0 scan .
+npm view secureai-scan@0.11.0 version dependencies dist.integrity
+npx --yes secureai-scan@0.11.0 --version
+npx --yes secureai-scan@0.11.0 scan .
 ```
 
 Confirm that `tree-sitter` and `tree-sitter-python` are runtime dependencies. Create the matching GitHub release from the tag and include the relevant changelog section.

README.md

@@ -18,7 +18,7 @@ Covers the official [OWASP Top 10 for LLM Applications 2026](https://genai.owasp
 ## Get started in 30 seconds
 
 ```bash
-npx --yes secureai-scan@0.10.0 scan .
+npx --yes secureai-scan@0.11.0 scan .
 ```
 
 No account, cloud upload, Python interpreter, or configuration required. TypeScript, JavaScript, Python, MCP configs, and Agent Skill bundles are detected automatically.

docs/index.html

@@ -506,7 +506,7 @@ <h3>Known-bad packages</h3>
   </div>
 
   <footer>
-    <p>For your own repository, run the full scanner: <code class="cli">npx secureai-scan@0.9.0 scan .</code> — traces prompt injection, RAG poisoning, and agent-privilege issues across your codebase, not just what you paste here. Read more: <a href="mcp-tool-poisoning.html">how to detect MCP tool poisoning</a> · <a href="prompt-injection-detection.html">how to detect prompt injection</a>.</p>
+    <p>For your own repository, run the full scanner: <code class="cli">npx secureai-scan@0.11.0 scan .</code> — traces prompt injection, RAG poisoning, and agent-privilege issues across your codebase, not just what you paste here. Read more: <a href="mcp-tool-poisoning.html">how to detect MCP tool poisoning</a> · <a href="prompt-injection-detection.html">how to detect prompt injection</a>.</p>
     <a href="https://github.com/akanthed/SecureAI-Scan" target="_blank" rel="noopener">SecureAI-Scan on GitHub</a>
   </footer>
 

docs/mcp-tool-poisoning.html

@@ -164,7 +164,7 @@ <h3>The actual payload</h3>
 
     <h2>Check it yourself</h2>
     <p>Paste a tool description, an <code>.mcp.json</code>, or server code into <a href="index.html">MCP X-Ray</a> — a free browser tool that runs these three checks client-side, nothing you paste leaves the page. For scanning an entire repository or MCP server before installing it, the <a href="https://github.com/akanthed/SecureAI-Scan">SecureAI-Scan</a> CLI runs the same checks (plus prompt-injection dataflow tracing and dependency advisories) with a single command:</p>
-    <p><code>npx secureai-scan@0.9.0 mcp owner/repo</code></p>
+    <p><code>npx secureai-scan@0.11.0 mcp owner/repo</code></p>
 
     <div class="cta">
       <p><strong>Try it now</strong> — paste a tool description and see the checks run in real time, entirely in your browser.</p>

docs/prompt-injection-detection.html

@@ -167,7 +167,7 @@ <h2>Trace it yourself</h2>
     </div>
 
     <p>Doing this by hand across a real codebase is slow and easy to miss — a value can pass through several functions before it reaches the sink. <a href="https://github.com/akanthed/SecureAI-Scan">SecureAI-Scan</a> automates exactly this trace via AST analysis (ts-morph for TypeScript/JavaScript, tree-sitter for Python), only flagging calls that resolve through real imports:</p>
-    <p><code>npx secureai-scan@0.9.0 scan .</code></p>
+    <p><code>npx secureai-scan@0.11.0 scan .</code></p>
 
     <div class="cta">
       <p><strong>Check an MCP tool description or config instead?</strong> That's a related but different check — invisible Unicode and injection phrasing in untrusted text, not code dataflow.</p>