The 1A is about freedom to express any idea or opinion, not about literally publishing or saying whatever you want. Purposeful lying, for instance, is not covered under 1A. Finding bugs for the purpose of selling them to people with malicious intent is malicious itself, and is very likely not covered under 1A. All rights imply a commensurate duty. You don't have freedom of speech for the purposes of harming others.

> Purposeful lying, for instance, is not covered under 1A.

Yes, it is. The restrictions to the first amendment are very tight and very narrow.

> You don't have freedom of speech for the purposes of harming others.

So, that's complicated. You can't incite violence, but you're more than allowed to disparage groups of people.

You can legally sell security bugs, as the NSA buys them all the time.

However, running a platform for the explicit goal of breaking security? Are you copying copyrighted code to achieve this goal? You're on shaky ground there.

Corellium uses its own bootloader IIRC.