There is something inherently wrong with a product that has not been assigned a price being defaulted to zero. I actually had a customer order his "free" device because it showed up in the catalog with a price of zero. If it were null, it would have missed the query. Some fields should allow null, some must allow null and yet others must not.

Definitely do 1,2 and 4. Item 3 optional. You'd think that vendor would really like to know about the vulnerability. Really stupid (lazy) design if only URL hack gets you to unauthorized content. Vendor should fire web designer.