It's really dependent on the company. Ruby RCE would have the same affect heartbleed would to an entirely Ruby stack company. I don't believe any company would

It's really dependent on the company. Ruby RCE would have the same affect heartbleed would to an entirely Ruby stack company. I don't believe any company would pay $1M for a bounty on their own systems. Only people who intend to use the vuln, or to fix it as they are the vendor. Fr a vuln to go for $1M requires "discovering SQL injection"-levels of vuln. MS paid $100K for an entire vuln class for ASLR/DEP bypass discovery, and promptly patched the shit out of it. For a remote vuln class, I could see them paying $1M quite happily to not have all of their products re-owned.