How much leakage is too much? 100uA is common, 200 happens pretty often. More than 300uA means the device is suspicious, and more than 500uA I would say is bad.
I usually go by RG Keen’s advice with fuzz face transistors when thinking about leakage:
http://www.geofex.com/article_folders/ffselect.htm