[zivkovicp]

Your examples seem pretty extreme, and I would say they are definitely not normal. I'd guess the leadership and engineering quality at this company is sub-par and they probably don't even realize the extent of the problem.

With that said, my experience is that security issues get taken care of when they are very dangerous, or only after the main product tasks get done. Fixing minor issues in a (NEW) product/company that might not survive the year is a comparative waste of time... survival comes first usually.