Document API security prerequisites

README.md

@@ -4,6 +4,7 @@
 ![Python](https://img.shields.io/badge/python-3.11%2B-green)
 ![License](https://img.shields.io/badge/license-Apache--2.0-orange)
 ![Docker](https://img.shields.io/badge/docker-ready-2496ED)
+![Security](https://img.shields.io/badge/security-no_PVE%2FPBS_writes-brightgreen)
 
 Python tool to generate a daily backup report for Proxmox VE against Proxmox Backup Server.
 
@@ -19,6 +20,15 @@ The application collects data via the PVE/PBS APIs, computes VM/CT coverage, ret
 - ⚠️ Anomalies section for errors or partial collection data.
 - 🐳 Recommended execution with Docker, or direct CLI execution.
 
+## 🔐 Prerequisites
+
+Create dedicated API users or tokens for this reporting application. They must be limited to audit/read-only permissions:
+
+- Proxmox VE: assign only the `PVEAuditor` role to the user or API token used by `PVE_API_TOKEN_ID`.
+- Proxmox Backup Server: assign only the `Audit` role to the user or API token used by each `PBS<number>_API_TOKEN_ID`.
+
+Do not use administrator or write-enabled accounts. The application only needs to read inventory, backup jobs, tasks, datastores, namespaces, snapshots and retention data.
+
 ## 🐳 Usage with Docker
 
 Docker is the recommended execution mode. The image includes the Python dependencies and system libraries required by WeasyPrint.