FirewallSync Practical cybersecurity writing for engineering teams that ship fast.

Write for Us

Pitch FirewallSync: practical, sourced security writing from engineers and practitioners on AppSec, identity, cloud, security operations and AI security. What we publish and how to pitch.

FirewallSync publishes practical, technically accurate security writing for software engineers, security practitioners and the people who lead them. If you have fixed something real, run an incident, rolled out a control across a fleet, or know a tool well enough to explain where it breaks, we want to hear from you.

Topics we cover

  • AppSec & APIs: authentication flaws, API authorization, secure defaults in frameworks, supply-chain security, SBOMs and signing
  • Identity & Access: OAuth and OIDC, passkeys and MFA, session handling, least privilege
  • Cloud Security: AWS, Azure and GCP configuration, Kubernetes, containers, infrastructure as code
  • Security Operations: vulnerability management and prioritization, detection, incident response, logging
  • AI Security: prompt injection, securing LLM applications and agents, model and data supply chain
  • Fundamentals: clear explanations of concepts engineers are expected to know but rarely get taught

What makes a good pitch

  • Specifics. A rollout plan, the configuration that worked, the log query that found the problem, the trade-off you had to make.
  • Experience you can describe. Postmortems and lessons learned are welcome; anonymize company details as needed.
  • A clear reader. Who is this for, and what will they be able to do after reading it?
  • An angle that isn’t already everywhere. If the top search results already cover it well, tell us what yours adds.

What we don’t publish

  • Generic “top 10 tips” or definition-only articles
  • Product pitches, including ones written as tutorials for a single vendor’s tool
  • Articles written to place a link
  • Content generated by an AI tool and submitted as your own work. You may use tools to help with editing, but the experience, analysis and claims must be yours, and you must tell us what tools you used.
  • Exploit code or step-by-step attack instructions against unpatched systems

Our standards

Guest articles follow the same editorial policy as our own work:

  • Original and unpublished. Not posted elsewhere, including your own blog, before or after we publish it, unless we agree otherwise.
  • Sourced. Link to the vendor documentation, advisories, specifications or CVE records behind your claims. We check them, and we will ask about anything we can’t verify.
  • Honest about testing. Say which versions you used and whether examples were run. Don’t describe testing you didn’t do.
  • Disclosed interests. Tell us if you work for, advise, invest in or are paid by any company or product the article mentions. We publish that disclosure with the article.

We edit every piece for accuracy, clarity and length, and you approve the final version before it goes live.

Accepted articles carry your name, a short bio and one link to your site or professional profile. Editorial guest articles are free to publish and are chosen on merit. If you want to promote a product or company, or are pitching on behalf of a client, see Advertise: paid placements are labeled as sponsored.

How to pitch

Email [email protected] with:

  1. A working title and two or three sentences on what the article covers and who it is for
  2. An outline, or a draft if you have one
  3. Your name, role, a one-line bio and links to anything you have written before
  4. Any affiliations to disclose

Please pitch before writing a full draft, so we can check the topic isn’t already scheduled. If we don’t reply within two weeks, feel free to pitch it elsewhere.