It&#x27;s really dependent on the company. Ruby RCE would have the same affect heartbleed would to an entirely Ruby stack company.<p>I don&#x27;t believe any company would pay $1M for a bounty on their own systems. Only people who intend to use the vuln, or to fix it as they are the vendor.<p>Fr a vuln to go for $1M requires &quot;discovering SQL injection&quot;-levels of vuln. MS paid $100K for an entire vuln class for ASLR&#x2F;DEP bypass discovery, and promptly patched the shit out of it. For a remote vuln class, I could see them paying $1M quite happily to not have all of their products re-owned.