diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0dd814d..497af78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.11.0 — 2026-08-27
+
+Ecosystem audit of public MCP servers turns up and fixes five precision bugs, plus a pre-commit hook and a VS Code extension scaffold for the distribution roadmap.
+
+### Fixed
+Found by scanning real third-party MCP servers (upstash/context7, cloudflare/mcp-server-cloudflare, stripe/agent-toolkit, awslabs/mcp):
+- **AI002** flagged secrets outside any LLM context (missing `llmFile` gate on the "secret" branch) — fired on a bcrypt hash logged in a plain demo app and a non-secret constant merely named with "KEY".
+- **isTestFilePath** didn't recognize `eval(s)` as a non-production path segment, so an LLM-as-judge eval harness (vitest-evals) was scanned as a real request handler.
+- **MCP001** compared a system-prompt string against a tainted variable name with a plain substring search instead of requiring a real identifier reference, producing a `proven`/critical false positive on prose that merely used the word "tools".
+- **MCP009/SKL003** cross-tool-reference detection resolved all 7 residual false positives by requiring the referenced tool name to sit between the trigger word and the verb (a redirect), not merely appear anywhere in the sentence (a normal "use X for Y" mention).
+
+### Added
+- **MCP011: untrusted tool source.** Flags an MCP tool handler that fetches from an external/unauthenticated source and returns the response as the tool result with no sanitization in between — the Sentry-MCP-DSN attack shape, where the tool server itself is the injection vector rather than the tool's static name/description (MCP007/MCP008).
+- **Pre-commit hook** (`.pre-commit-hooks.yaml`) — run this scanner as a pre-commit.com hook, catching findings before push instead of after.
+- **VS Code extension scaffold** (`vscode-extension/`) — wraps the CLI and reports findings as Problems-panel diagnostics; local-build install only, not yet published to the Marketplace.
+- Example compliance artifact (`docs/examples/THREAT_MODEL.example.md`) and a real terminal-recording demo.
+
+### Also
+- `docs/RealWorldFindings.md` updated with the full ecosystem-audit writeup.
+- Roadmap corrected on competitive positioning (Invariant Labs/MCP-Scan → Snyk Agent Scan).
+
 ## 0.10.0 — 2026-08-19
 
 Static config scanning for LiteLLM Proxy, plus six false-positive/robustness bugs found and fixed by adding a large real-world repo (BerriAI/litellm) to the regression gate.
diff --git a/README.md b/README.md
index 913e1f6..83dbde3 100644
--- a/README.md
+++ b/README.md
@@ -101,7 +101,7 @@ If you already run Semgrep or GHAS, keep them — add SecureAI-Scan for the risk
 
 `secureai-scan scan .` end to end, real output against a real (small, deliberately vulnerable) file — [source](docs/demo-source):
 
-<img src="docs/demo.svg" alt="Terminal recording of secureai-scan scan . finding a traced prompt-injection vulnerability" width="700">
+<img src="docs/secure.gif" alt="Terminal recording of secureai-scan scan . finding a traced prompt-injection vulnerability" width="700">
 
 Attack shapes the scanner traces end to end:
 
diff --git a/docs/secure.gif b/docs/secure.gif
new file mode 100644
index 0000000..b11297d
Binary files /dev/null and b/docs/secure.gif differ
diff --git a/package-lock.json b/package-lock.json
index c327760..9ba605c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "secureai-scan",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "secureai-scan",
-      "version": "0.10.0",
+      "version": "0.11.0",
       "license": "MIT",
       "dependencies": {
         "commander": "^15.0.0",
@@ -969,6 +969,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -1108,6 +1109,7 @@
       "integrity": "sha512-mrcEdkYtHfrK1A6fs3O6FxkBo0Qig5XUXqHhxUOQu0bmPo00QF4XaSx4edpazdHwxnSCjlGKGgIqWdaN4dvTLA==",
       "hasInstallScript": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "node-addon-api": "^8.5.0",
         "node-gyp-build": "^4.8.4"
diff --git a/package.json b/package.json
index f1986b3..0ad8a0a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "secureai-scan",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "AST-based AI security scanner for TypeScript, JavaScript, and Python with dataflow evidence for prompt injection, MCP, Agent Skill, and RAG risks.",
   "author": "Akshay Kanthed",
   "license": "MIT",