You can legally sell security bugs, as the NSA buys them all the time.

However, running a platform for the explicit goal of breaking security? Are you copying copyrighted code to achieve this goal? You're on shaky ground there.