generated: '2026-09-05'
method: probed
source: https://www.nasdaq.com/security.txt
provider: Calypso Migration
providerId: calypso-migration
description: >-
  Vulnerability disclosure posture for Nasdaq Calypso Migration. Nasdaq — the
  operator of the Calypso platform and of the professional-services engagement
  this record profiles — publishes a security.txt naming a managed responsible
  disclosure program run on Synack. Calypso Migration itself has no separate
  security page; the parent corporate program is the only disclosure route
  published for it.
ownership_note: >-
  The document is served from www.nasdaq.com, not from calypso.com. That is the
  correct domain for this record: Nasdaq acquired Adenza (and with it Calypso
  Technology) in 2023, every Calypso product and services page now lives under
  nasdaq.com/products/fintech/calypso, and www.calypso.com no longer answers on
  port 80 or 443 at all.
disclosure:
  published: true
  security_txt:
    url: https://www.nasdaq.com/security.txt
    http_status: 200
    content_type: text/plain
    file: ../well-known/calypso-migration-security.txt
    rfc9116_canonical_path: false
    path_note: >-
      Served at the legacy root path /security.txt.
      https://www.nasdaq.com/.well-known/security.txt returns 404, so a client
      following RFC 9116 will not find it.
    fields_present:
      - Contact
      - Acknowledgements
    fields_absent:
      - Expires
      - Encryption
      - Preferred-Languages
      - Policy
      - Canonical
    expires_note: >-
      RFC 9116 REQUIRES an Expires field. This document has none, so a strict
      parser treats it as non-conformant.
  contact: https://nasdaq.responsibledisclosure.com/hc/en-us
  acknowledgements: https://nasdaq.responsibledisclosure.com/hc/en-us/articles/360022894593
  policy_url: null
  policy_note: >-
    No Policy: field is published and no public safe-harbour / scope statement
    was found. The disclosure portal itself returned HTTP 403 to an
    unauthenticated probe (both with and without a browser User-Agent), so the
    program's scope, rules and rewards could not be read.
bug_bounty:
  program: Synack
  platform: synack
  managed: true
  portal: https://nasdaq.responsibledisclosure.com/hc/en-us
  portal_http_status: 403
  public_scope_published: false
  note: >-
    security.txt states plainly "you may report it to us on Synack". Synack is a
    managed, invite-only researcher platform rather than an open public bounty,
    which is consistent with the portal refusing anonymous reads.
evidence:
  - url: https://www.nasdaq.com/security.txt
    status: 200
    checked: '2026-09-05'
  - url: https://www.nasdaq.com/.well-known/security.txt
    status: 404
    checked: '2026-09-05'
  - url: https://nasdaq.responsibledisclosure.com/hc/en-us
    status: 403
    checked: '2026-09-05'
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com