diff --git a/README.md b/README.md
index 9d302b9..327ef49 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,8 @@ discoverable by CMake. The default build uses CPM.cmake and downloads Drogon
 - `AGENTS.md`: durable instructions for coding agents.
 - `docs/LLM_CONTEXT.md`: short project context for future LLM sessions.
 - `docs/MILESTONE_01.md`: what this milestone implemented and what comes next.
+- `docs/MILESTONE_02.md`: workflow and authorization milestone.
+- `docs/MILESTONE_03.md`: media upload, OpenAPI generator and API lab milestone.
 - `docs/API_SPEC.md`: API surface.
 - `docs/DATABASE_SCHEMA.md`: schema overview.
 - `docs/ARCHITECTURE.md`: backend structure.
diff --git a/docs/LLM_CONTEXT.md b/docs/LLM_CONTEXT.md
index 591a8fd..4d22b01 100644
--- a/docs/LLM_CONTEXT.md
+++ b/docs/LLM_CONTEXT.md
@@ -17,5 +17,5 @@ Important conventions:
 - Use Drogon references from `/home/gabdevele/Projects/snitchitaly/backend/drogon`
   and `https://drogonframework.github.io/drogon-docs/`.
 - `AGENTS.md` is the durable agent instruction entrypoint.
-- `docs/MILESTONE_01.md` and later milestone files describe what has been
-  implemented and what comes next.
+- `docs/MILESTONE_01.md`, `docs/MILESTONE_02.md` and `docs/MILESTONE_03.md`
+  describe what has been implemented and what comes next.
diff --git a/docs/MILESTONE_03.md b/docs/MILESTONE_03.md
new file mode 100644
index 0000000..4cd1a56
--- /dev/null
+++ b/docs/MILESTONE_03.md
@@ -0,0 +1,21 @@
+# Milestone 03: Media, OpenAPI and API Lab
+
+## Implemented in this milestone
+- Removed legacy `sha256$` password verification and updated local admin seeds to
+  PBKDF2-HMAC-SHA256.
+- Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower
+  than plain SHA-256 and available through the existing OpenSSL dependency.
+- Added report media uploads at `POST /api/v1/reports/{id}/media`.
+- Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
+- Kept `POST /api/v1/reports/{id}/photos` as a temporary compatibility alias.
+- Added generated OpenAPI JSON from Drogon controller route macros.
+- Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
+- Added a small Streamlit API lab for visual endpoint testing.
+
+## To do next
+- Add richer OpenAPI schema metadata for request and response bodies.
+- Consider extracting `tools/drogon-openapi-gen` into an open-source standalone
+  project once the conventions stabilize.
+- Add minimal media upload integration tests after endpoint contracts settle.
+- Replace the compatibility `/photos` alias once external scripts use `/media`.
+- Keep the Streamlit lab small and replace it with the real frontend later.