generated: '2026-09-10'
method: probed
source: >-
  probe-security-programs.py plus manual probes of fluor.com security paths, HackerOne and
  Bugcrowd.
published: false
note: >-
  Fluor Corporation publishes no vulnerability disclosure policy that a reporter can reach.
  Recorded as an explicit negative so a later run does not re-credit the HackerOne directory
  entry below, which looks like a program and is not one.
probes:
  - url: https://www.fluor.com/.well-known/security.txt
    status: 404
  - url: https://www.fluor.com/security
    status: 404
  - url: https://www.fluor.com/vulnerability-disclosure
    status: 404
  - url: https://www.fluor.com/responsible-disclosure
    status: 404
  - url: https://hackerone.com/fluor
    status: 404
  - url: https://bugcrowd.com/fluor
    status: 404
  - url: https://hackerone.com/fluorcorp
    status: 200
    finding: not-a-published-program
    detail: >-
      HackerOne serves a directory placeholder for "Fluor Corporation" (handle fluorcorp,
      id 5649, scopes fluor.com and fluor.es). Its own JSON says is_external_program: true,
      external_program.claimed: false, policy: null, policy_url: null, disclosure_email: "",
      disclosure_url: "", offers_rewards: false. Nobody at Fluor has claimed it and no
      policy text exists, so it is a HackerOne-generated stub, not a Fluor-published
      disclosure program. No Security pointer is emitted for it.
bug_bounty: none
security_txt: none
disclosure_contact: none