secured the plugin a bit for 0.1.1

README.md

@@ -19,7 +19,7 @@ PLUGINS = ["proxmox_power_button"]
 
 PLUGINS_CONFIG = {
     "proxmox_power_button": {
-        "verify_ssl": False,
+        "verify_ssl": True,  # set False only for self-signed lab certs
         "stop_mode": "shutdown",
         "reboot_mode": "reboot",
     },
@@ -82,15 +82,35 @@ for both QEMU and LXC.
 
 | key           | default      | meaning                                  |
 |---------------|--------------|------------------------------------------|
-| `verify_ssl`  | `False`      | verify Proxmox TLS cert                  |
+| `verify_ssl`  | `True`       | verify Proxmox TLS cert (set `False` only for self-signed lab certs) |
 | `stop_mode`   | `"shutdown"` | `shutdown` (graceful ACPI) or `stop` (hard) |
 | `reboot_mode` | `"reboot"`   | `reboot` (graceful) or `reset` (hard)    |
 
-## Notes / caveats
+## Security
 
-- **Token is stored in a plain-text custom field** and is visible to anyone who
-  can view the cluster. Use a scoped, least-privilege Proxmox API token and
-  restrict cluster view permissions. NetBox has no "secret" custom-field type.
+- **Token is stored in a plain-text custom field.** It is visible to anyone who
+  can *view* the cluster — in the UI, in REST API responses for the cluster,
+  and in change-log data. NetBox has no "secret" custom-field type, so:
+  - restrict Cluster **view** permissions to administrators only;
+  - use a least-privilege Proxmox API token: only `VM.Audit` + `VM.PowerMgmt`,
+    scoped to the specific VMs or pool this plugin should manage — never a
+    `root@pam` token with datacenter-wide rights. Anyone who can read the
+    field can extract the token and drive the hypervisor directly.
+- **Permissions.** The buttons render only for users with
+  `virtualization.change_virtualmachine`, and the action endpoint enforces
+  NetBox's **object-scoped** permissions: a user whose change permission is
+  constrained (e.g. to one tenant's VMs) gets a 404 on any VM outside that
+  scope — the same behaviour as core NetBox object views.
+- **TLS verification is on by default.** The Proxmox API token crosses this
+  connection on every power action; leaving `verify_ssl` at `True` prevents
+  token theft via MitM. Only set it to `False` for self-signed lab
+  certificates.
+- **Error detail goes to the log, not the browser.** Failed actions show a
+  generic message; the full Proxmox/network error (which may contain internal
+  hostnames, URLs, or response bodies) is written to the
+  `proxmox_power_button` logger.
+
+## Notes / caveats
 - **Requires NetBox ≥ 4.5.0.** The data migration depends on
   `extras.0134_owner` and `virtualization.0052_gfk_indexes`, which first appear
   in 4.5.0; on 4.4 or older `migrate` fails with `NodeNotFoundError`. Bump