[Linux] [Security] How much leeway do I give a vendor before I get pissed off?

I'm in the process of building a Chef cookbook that installs an analytical database that I'd like to keep nameless for the time being. I am an engineer for a small startup and I'm basically just evaluating this database right now, and have leeway to tell them that I'm not going to buy it. I am also a security professional, and we're contractually obligated to harden our systems (so even if I didn't want to for some reason, I have to).

The first thing to build is the management console's image. I poke around the RPM that installs the thing, and they use the RPM scriptlets to unharden the system. They modify limits.conf so that all processes by all users have unlimited address space and 65k file descriptors.

This is egregious, but I worked around this by extracting the RPM and installing it by hand (well, okay, a script does it). The next problem? The application uses JRE 7u80, which they bundle with the application, and hasn't received security updates in 2.5 years. So, I ripped that fucker out and made it use OpenJDK 7u151, which is up to date. And since it's the system installation of OpenJDK, security updates happen automatically.

The Java web application also defaults to running as root. I haven't entirely fixed this, but I am working on it.

It seems to be working, but my build audit script is finding a shit ton of files from the application that are world-writable. Upon further investigation, they set `umask 000` in their startup script. So, I've patched that with `sed` to `umask 007`.

I've brought some of these vulnerabilities to their sales people's attention, and all they could tell me is that it passed all the security audits done by their biggest customers - AT&T, Bank of America, Intuit, Apple, etc. But I cannot fathom how these egregious violations of basic OS security could ever pass muster.

Am I being too paranoid? Or are these huge megacorps just OK tossing this insecure mess behind 10 levels of security software and passing this database system without caring about the fact that there are rookie programmer mistakes that should not be tolerated? `umask 000` is almost the final straw for me. There is no universe where that is acceptable.

I also think it's funny that the list of customers the sales person gave me have all had at least one security breach.