An hour or two of ancillary work? Do it as a favor, not a billable project.
Negotiate scope, not rate. Try to make rate immutable.
You are charging too little.
Your rate is probably not a straightforward function of what your fulltime equivalent makes.
Get an accountant now.
Have a well-defined master contract and a separate statement of work (SOW) for each project.
Get acceptance criteria into the SOW, but don't make it ultra-specific or you'll invite arguments.
Incorporate. It's cheap insurance.
Get a lawyer and have your contracts reviewed.
Expect to work on your customers' paper, not yours. See: get a lawyer.
Reach out periodically to all your not-unsatisfied clients. You'll be surprised how much work this drums up.
Specialize on domain, not on technology stacks.
(I'm reading between the lines to assume that you don't actually have a problem with teams standardizing around a specific stack, but rather that they shouldn't market themselves that way; either way, that's not really the interesting part.)
Your counterargument is going to be "don't do government stuff" I'm sure.
That's a rule that has served us in pretty good stead.
It's not just the moral issue (though I do have dealbreaking moral problems with doing the kind of work I do for the USG) but also that the market for GSA-style services is so different than the regular market; not only is it harder and weirder to address as a market, but also succeeding there doesn't teach you much about how to make your offerings work in the real market.
(I've worked, earlier in my career, on somewhat large-scale projects [not in vuln research] serving government agencies, but have never been a principal at a company that targeted government sales, so, grain of salt or whatever).
GSA products sales aren't so bad, and sometimes services are incidental to product sales. If I were a lock maker, I'd sure want to be Kaba-Mas or S&G with a decent amount of government sales. If you have to provide some services, it's not horrible -- it's a $200-400k/yr living for a few consultants if you're in the right space, and generates nice revenue for the company, without taking over the focus. If you're an independent contractor and end up subcontracting to a product company, you can make really good money filling this role. If you don't have to do the "get the product sold" phase, and are purely subcontracted to the the implementation/support, it's actually not bad, and not very different from enterprise clients in general. There is the problem of single-client-all-revenue, and some slightly odd work rules, but enterprise often has that.
I share your moral concerns about vuln research/etc. for the government, but I have no problem with defensive tech for them, or for non-security tech.
When providing estimates, plan for 30-32 hours/week of reasonable full-time effort. If you estimate assuming you will be able to dedicate 40 hours/week to one thing, you may find yourself working a shitload of overtime.
Be firm with the client. If you believe a feature request is out of scope, say something and create a change order.
Finally, knock their socks off and they might have a referral for you!
HAVE A GOOD CONTRACT.
When projects go smoothly, you hardly have to refer back to the contract and in many cases it is a formality.
But, When things go wrong such as delays, changes or cancellations to name a few. A bad contract will leave too many scenarios to negotiation and that is where problems come up.
Also:
- Good Communication. Not only something that works for you, but for your client.
- Charge a rate that will make you want to finish the project even if it goes over a bit. We sometimes ignore these things as we look at the bigger picture, but you do not wan't to be crossing that line where you feel that you undercharged or over promised, it makes life miserable.
- Hiscox.com for insurance, nice monthly payments that are affordable. Simple enough.
- Take breaks, in advance. Whether it be a trip or a couple days off to yourself. Plan them and do your best to not cancel them. Freelancing has a way of sucking you in to this endless cycle of work. If your not freelancing to 1. Make more money 2. Have more freedom or 3. Build your experience...then I'm sorry to say, it's a bad idea.
Congrats on the project, you must of done well or charged too little, either way, if you start with most of the suggestions on this thread in mind, you will be ahead of the game.
If you enjoy the client and the relationship, hang on to it! They are few and far between more often than not.
A few tools we use are: Xero, Toggl, Asana. Always try to optimize your own workflow, but structure it in such a way that it's not all in your head. Your process and hand off is just as valuable as the product itself.
We've had a lot more success tying hours to features instead of defined project scope. Let it creep and change, just be up front with costs and expectations. Realize that your time and work is not flexible, but the feature list is.
Let the client help define the product scope collaboratively with you. You already landed them, so you just need to focus on keeping them.
Since it's not your full time, set mental boundaries for yourself and try to keep the two jobs separate.