I actually did this for a guy on upwork. It was fun, but not a sustainable business. Security audits are where there's money.